@4pm/cli 1.25.0 → 1.28.0-b

package/dist/index.js

@@ -5713,14 +5713,14 @@ var require_react_development = __commonJS({
               var thenableResult = result;
               var wasAwaited = false;
               var thenable = {
-                then: function(resolve12, reject) {
+                then: function(resolve13, reject) {
                   wasAwaited = true;
                   thenableResult.then(function(returnValue2) {
                     popActScope(prevActScopeDepth);
                     if (actScopeDepth === 0) {
-                      recursivelyFlushAsyncActWork(returnValue2, resolve12, reject);
+                      recursivelyFlushAsyncActWork(returnValue2, resolve13, reject);
                     } else {
-                      resolve12(returnValue2);
+                      resolve13(returnValue2);
                     }
                   }, function(error2) {
                     popActScope(prevActScopeDepth);
@@ -5750,20 +5750,20 @@ var require_react_development = __commonJS({
                   ReactCurrentActQueue.current = null;
                 }
                 var _thenable = {
-                  then: function(resolve12, reject) {
+                  then: function(resolve13, reject) {
                     if (ReactCurrentActQueue.current === null) {
                       ReactCurrentActQueue.current = [];
-                      recursivelyFlushAsyncActWork(returnValue, resolve12, reject);
+                      recursivelyFlushAsyncActWork(returnValue, resolve13, reject);
                     } else {
-                      resolve12(returnValue);
+                      resolve13(returnValue);
                     }
                   }
                 };
                 return _thenable;
               } else {
                 var _thenable2 = {
-                  then: function(resolve12, reject) {
-                    resolve12(returnValue);
+                  then: function(resolve13, reject) {
+                    resolve13(returnValue);
                   }
                 };
                 return _thenable2;
@@ -5779,7 +5779,7 @@ var require_react_development = __commonJS({
             actScopeDepth = prevActScopeDepth;
           }
         }
-        function recursivelyFlushAsyncActWork(returnValue, resolve12, reject) {
+        function recursivelyFlushAsyncActWork(returnValue, resolve13, reject) {
           {
             var queue = ReactCurrentActQueue.current;
             if (queue !== null) {
@@ -5788,16 +5788,16 @@ var require_react_development = __commonJS({
                 enqueueTask(function() {
                   if (queue.length === 0) {
                     ReactCurrentActQueue.current = null;
-                    resolve12(returnValue);
+                    resolve13(returnValue);
                   } else {
-                    recursivelyFlushAsyncActWork(returnValue, resolve12, reject);
+                    recursivelyFlushAsyncActWork(returnValue, resolve13, reject);
                   }
                 });
               } catch (error2) {
                 reject(error2);
               }
             } else {
-              resolve12(returnValue);
+              resolve13(returnValue);
             }
           }
         }
@@ -16203,9 +16203,9 @@ var require_react_reconciler_development = __commonJS({
           var node = row;
           while (node !== null) {
             if (node.tag === SuspenseComponent) {
-              var state2 = node.memoizedState;
-              if (state2 !== null) {
-                var dehydrated = state2.dehydrated;
+              var state3 = node.memoizedState;
+              if (state3 !== null) {
+                var dehydrated = state3.dehydrated;
                 if (dehydrated === null || isSuspenseInstancePending(dehydrated) || isSuspenseInstanceFallback(dehydrated)) {
                   return node;
                 }
@@ -16549,8 +16549,8 @@ var require_react_reconciler_development = __commonJS({
             stores: null
           };
         }
-        function basicStateReducer(state2, action) {
-          return typeof action === "function" ? action(state2) : action;
+        function basicStateReducer(state3, action) {
+          return typeof action === "function" ? action(state3) : action;
         }
         function mountReducer(reducer, initialArg, init) {
           var hook = mountWorkInProgressHook();
@@ -18537,10 +18537,10 @@ var require_react_reconciler_development = __commonJS({
               }
             }
           }
-          var state2 = workInProgress2.memoizedState = instance.state !== null && instance.state !== void 0 ? instance.state : null;
+          var state3 = workInProgress2.memoizedState = instance.state !== null && instance.state !== void 0 ? instance.state : null;
           adoptClassInstance(workInProgress2, instance);
           {
-            if (typeof ctor.getDerivedStateFromProps === "function" && state2 === null) {
+            if (typeof ctor.getDerivedStateFromProps === "function" && state3 === null) {
               var componentName = getComponentNameFromType(ctor) || "Component";
               if (!didWarnAboutUninitializedState.has(componentName)) {
                 didWarnAboutUninitializedState.add(componentName);
@@ -19463,8 +19463,8 @@ var require_react_reconciler_development = __commonJS({
                 var _instance = workInProgress2.stateNode;
                 var ctor = workInProgress2.type;
                 var tempInstance = new ctor(workInProgress2.memoizedProps, _instance.context);
-                var state2 = tempInstance.state;
-                _instance.updater.enqueueSetState(_instance, state2, null);
+                var state3 = tempInstance.state;
+                _instance.updater.enqueueSetState(_instance, state3, null);
                 break;
               }
               case true: {
@@ -20239,8 +20239,8 @@ var require_react_reconciler_development = __commonJS({
           var node = firstChild;
           while (node !== null) {
             if (node.tag === SuspenseComponent) {
-              var state2 = node.memoizedState;
-              if (state2 !== null) {
+              var state3 = node.memoizedState;
+              if (state3 !== null) {
                 scheduleSuspenseWorkOnFiber(node, renderLanes2, workInProgress2);
               }
             } else if (node.tag === SuspenseListComponent) {
@@ -20669,9 +20669,9 @@ var require_react_reconciler_development = __commonJS({
               }
               break;
             case SuspenseComponent: {
-              var state2 = workInProgress2.memoizedState;
-              if (state2 !== null) {
-                if (state2.dehydrated !== null) {
+              var state3 = workInProgress2.memoizedState;
+              if (state3 !== null) {
+                if (state3.dehydrated !== null) {
                   pushSuspenseContext(workInProgress2, setDefaultShallowSuspenseContext(suspenseStackCursor.current));
                   workInProgress2.flags |= DidCapture;
                   return null;
@@ -28557,11 +28557,12 @@ function fetchWhoami(serverUrl, hashcode3) {
 function selfUnlink(serverUrl, hashcode3) {
   return post(serverUrl, "/machine-links/self-unlink", { hashcode3 });
 }
-async function fetchCliVersion(serverUrl) {
+async function fetchCliVersion(serverUrl, version) {
   const ctrl = new AbortController();
   const timer = setTimeout(() => ctrl.abort(), 2e4);
   try {
-    const res = await fetch(`${serverUrl}/meta/cli-version`, { signal: ctrl.signal });
+    const query = version ? `?version=${encodeURIComponent(version)}` : "";
+    const res = await fetch(`${serverUrl}/meta/cli-version${query}`, { signal: ctrl.signal });
     return unwrap(res);
   } finally {
     clearTimeout(timer);
@@ -28798,6 +28799,8 @@ var en_default = {
   "update.updating": "Updating {from} \u2192 {to}\u2026",
   "update.checkVersionFailed": "Could not check cli version: {error}",
   "update.newVersionAutoUpdateOff": "A new version {latest} is available (running {current}) \u2014 autoUpdate is off.",
+  "update.unsupportedSoon": "cli {current} stops being supported on {date} \u2014 update before then (4pm update).",
+  "update.policyNote": "Note from 4PM: {note}",
   "update.applying": "{kind} cli update {from} \u2192 {to}\u2026",
   "update.kindMandatory": "Mandatory",
   "update.kindAutomatic": "Automatic",
@@ -28981,6 +28984,8 @@ var vi_default = {
   "update.updating": "\u0110ang c\u1EADp nh\u1EADt {from} \u2192 {to}\u2026",
   "update.checkVersionFailed": "Kh\xF4ng th\u1EC3 ki\u1EC3m tra phi\xEAn b\u1EA3n cli: {error}",
   "update.newVersionAutoUpdateOff": "C\xF3 phi\xEAn b\u1EA3n m\u1EDBi {latest} (\u0111ang ch\u1EA1y {current}) \u2014 autoUpdate \u0111ang t\u1EAFt.",
+  "update.unsupportedSoon": "cli {current} s\u1EBD ng\u1EEBng \u0111\u01B0\u1EE3c h\u1ED7 tr\u1EE3 t\u1EEB {date} \u2014 h\xE3y c\u1EADp nh\u1EADt tr\u01B0\u1EDBc ng\xE0y \u0111\xF3 (4pm update).",
+  "update.policyNote": "Ghi ch\xFA t\u1EEB 4PM: {note}",
   "update.applying": "C\u1EADp nh\u1EADt cli {kind} {from} \u2192 {to}\u2026",
   "update.kindMandatory": "b\u1EAFt bu\u1ED9c",
   "update.kindAutomatic": "t\u1EF1 \u0111\u1ED9ng",
@@ -29164,6 +29169,8 @@ var ja_default = {
   "update.updating": "\u66F4\u65B0\u4E2D {from} \u2192 {to}\u2026",
   "update.checkVersionFailed": "cli \u306E\u30D0\u30FC\u30B8\u30E7\u30F3\u3092\u78BA\u8A8D\u3067\u304D\u307E\u305B\u3093\u3067\u3057\u305F: {error}",
   "update.newVersionAutoUpdateOff": "\u65B0\u3057\u3044\u30D0\u30FC\u30B8\u30E7\u30F3 {latest} \u304C\u5229\u7528\u53EF\u80FD\u3067\u3059\uFF08\u5B9F\u884C\u4E2D {current}\uFF09\u2014 autoUpdate \u306F\u30AA\u30D5\u3067\u3059\u3002",
+  "update.unsupportedSoon": "cli {current} \u306F {date} \u306B\u30B5\u30DD\u30FC\u30C8\u304C\u7D42\u4E86\u3057\u307E\u3059 \u2014 \u305D\u308C\u307E\u3067\u306B\u66F4\u65B0\u3057\u3066\u304F\u3060\u3055\u3044\uFF084pm update\uFF09\u3002",
+  "update.policyNote": "4PM \u304B\u3089\u306E\u304A\u77E5\u3089\u305B: {note}",
   "update.applying": "{kind} \u306E cli \u66F4\u65B0 {from} \u2192 {to}\u2026",
   "update.kindMandatory": "\u5FC5\u9808",
   "update.kindAutomatic": "\u81EA\u52D5",
@@ -29347,6 +29354,8 @@ var zh_default = {
   "update.updating": "\u6B63\u5728\u66F4\u65B0 {from} \u2192 {to}\u2026",
   "update.checkVersionFailed": "\u65E0\u6CD5\u68C0\u67E5 cli \u7248\u672C\uFF1A{error}",
   "update.newVersionAutoUpdateOff": "\u6709\u65B0\u7248\u672C {latest} \u53EF\u7528\uFF08\u5F53\u524D\u8FD0\u884C {current}\uFF09\u2014 autoUpdate \u5DF2\u5173\u95ED\u3002",
+  "update.unsupportedSoon": "cli {current} \u5C06\u4E8E {date} \u505C\u6B62\u652F\u6301 \u2014 \u8BF7\u5728\u6B64\u4E4B\u524D\u66F4\u65B0\uFF084pm update\uFF09\u3002",
+  "update.policyNote": "\u6765\u81EA 4PM \u7684\u8BF4\u660E\uFF1A{note}",
   "update.applying": "{kind} cli \u66F4\u65B0 {from} \u2192 {to}\u2026",
   "update.kindMandatory": "\u5F3A\u5236",
   "update.kindAutomatic": "\u81EA\u52A8",
@@ -29541,7 +29550,7 @@ async function runLink(serverUrl, explicitProfile, token = null) {
 
 // src/commands/start.ts
 import { spawn as spawn11 } from "child_process";
-import { join as join37 } from "path";
+import { join as join38 } from "path";
 
 // src/core/update.ts
 import { execSync as execSync2 } from "child_process";
@@ -32701,12 +32710,18 @@ async function checkAndUpdate(serverUrl, autoUpdate) {
   if (CLI_VERSION.startsWith("0.0.0")) return { action: "none" };
   let meta;
   try {
-    meta = await fetchCliVersion(serverUrl);
+    meta = await fetchCliVersion(serverUrl, CLI_VERSION);
   } catch (err) {
     console.warn(t("update.checkVersionFailed", { error: String(err) }));
     return { action: "none" };
   }
-  const mandatory = compareSemver(CLI_VERSION, meta.minSupported) < 0;
+  const mandatory = compareSemver(CLI_VERSION, meta.minSupported) < 0 || meta.status === "unsupported";
+  if (meta.status === "warning" && meta.unsupportedFrom) {
+    console.warn(t("update.unsupportedSoon", { current: CLI_VERSION, date: meta.unsupportedFrom.slice(0, 10) }));
+    if (meta.note) console.warn(t("update.policyNote", { note: meta.note }));
+  } else if (meta.status === "unsupported" && meta.note) {
+    console.warn(t("update.policyNote", { note: meta.note }));
+  }
   const outdated = shouldUpdateTo(CLI_VERSION, meta.latest);
   if (!outdated) return { action: "none" };
   if (!mandatory && !autoUpdate) {
@@ -32754,7 +32769,7 @@ async function checkAndUpdate(serverUrl, autoUpdate) {
 // src/core/ws-client.ts
 init_wrapper();
 import { randomUUID as randomUUID4 } from "crypto";
-import { basename as basename7, join as join32 } from "path";
+import { basename as basename7, join as join33 } from "path";
 import { existsSync as existsSync18, mkdirSync as mkdirSync9 } from "fs";
 
 // vendor/@4pm/utils/helpers.ts
@@ -37049,6 +37064,17 @@ function githubHostKind(host) {
   if (h.endsWith(".ghe.com")) return "ghe-cloud";
   return "ghes";
 }
+var scaffoldPublishRequestSchema = external_exports.object({
+  machineLinkId: external_exports.string().uuid().optional()
+});
+
+// vendor/@4pm/dto/git-overview.ts
+var GIT_SNAPSHOT_LIMITS = {
+  localCommits: 50,
+  filesPerCommit: 100,
+  dirtyFiles: 200,
+  remoteCommits: 200
+};
 
 // vendor/@4pm/validation/schemas.ts
 var passwordSchema = external_exports.string().min(8, "password: at least 8 characters").max(32, "password: at most 32 characters").regex(/[a-zA-Z]/, "password: needs at least 1 letter").regex(/[0-9]/, "password: needs at least 1 digit");
@@ -37255,6 +37281,67 @@ var agentToolsWriteRequestSchema = external_exports.object({
   permissions: agentToolsPermissionsSchema
 });
 
+// vendor/@4pm/dto/meta.ts
+var cliVersionString = external_exports.string().trim().regex(/^\d+\.\d+\.\d+([-+][0-9A-Za-z.-]+)?$/);
+var setCliMinVersionRequestSchema = external_exports.object({
+  minSupported: cliVersionString.nullable(),
+  disconnect: external_exports.boolean().optional()
+});
+var setCliVersionOverrideRequestSchema = external_exports.object({
+  status: external_exports.enum(["supported", "warning", "unsupported"]),
+  unsupportedFrom: external_exports.string().datetime({ offset: true }).nullable().optional(),
+  note: external_exports.string().max(500).optional(),
+  disconnect: external_exports.boolean().optional()
+});
+
+// vendor/@4pm/dto/storage.ts
+var STORAGE_KINDS = [
+  "messageText",
+  "postText",
+  "commentText",
+  "memoText",
+  "messageImages",
+  "messageFiles",
+  "postImages",
+  "postFiles",
+  "commentImages",
+  "commentFiles",
+  "memoImages",
+  "memoFiles",
+  "templates",
+  "aiDocImages",
+  "artifacts",
+  "commandHistory"
+];
+var COMMUNITY_STORAGE_KINDS = [
+  "messageText",
+  "postText",
+  "commentText",
+  "messageImages",
+  "messageFiles",
+  "postImages",
+  "postFiles",
+  "commentImages",
+  "commentFiles"
+];
+var SERVER_CLEARABLE_STORAGE_KINDS = [
+  "memoText",
+  "memoImages",
+  "memoFiles",
+  "templates",
+  "commandHistory"
+];
+var CLEARABLE_STORAGE_KINDS = [
+  ...COMMUNITY_STORAGE_KINDS,
+  ...SERVER_CLEARABLE_STORAGE_KINDS
+];
+var storageClearRequestSchema = external_exports.object({
+  kinds: external_exports.array(external_exports.enum(STORAGE_KINDS)).min(1).max(STORAGE_KINDS.length),
+  before: external_exports.string().datetime({ offset: true }),
+  /** org-0009 / community-0015 only — must equal the org name. */
+  confirm: external_exports.string().max(200).optional()
+});
+
 // vendor/@4pm/dto/org.ts
 var CLI_SETTINGS_BOUNDS = {
   reconnectMaxBackoffSec: { min: 5, max: 60 },
@@ -37274,6 +37361,8 @@ var TEMPLATE_KINDS = ["report", "est", "wbs", "proposal", "feasibility"];
 // vendor/@4pm/dto/project.ts
 var listProjectsQuerySchema = baseRequestSchema.extend({
   pinned: pinnedFilterSchema,
+  /** Only projects this team is attached to (project-0001; the public v1 list — ADR-0364). */
+  teamId: external_exports.string().uuid().optional(),
   /** ADMIN-only Trash: list soft-deleted projects (ADR-0109). */
   deleted: deletedFilterSchema
 });
@@ -37562,7 +37651,7 @@ var userCardsQuerySchema = external_exports.object({
 });
 
 // src/core/scaffold.ts
-import { cp, mkdir, mkdtemp, rm, writeFile } from "fs/promises";
+import { cp, mkdir, mkdtemp, readFile, rm, writeFile } from "fs/promises";
 import { existsSync as existsSync4 } from "fs";
 import { execFile } from "child_process";
 import { tmpdir as tmpdir2 } from "os";
@@ -37671,45 +37760,98 @@ function providerSlug(url) {
   const m2 = /(?:github|gitlab)\.com[/:]+([^/]+\/.+?)(?:\.git)?\/?$/i.exec(url);
   return { provider, slug: m2?.[1] ?? "" };
 }
-async function commitAndOpenPr(root, repo, emit) {
-  emit("commit", "Committing the scaffolded project\u2026");
-  await run("git", ["add", "-A"], { cwd: root, timeout: 6e4 });
-  const staged = (await run("git", ["diff", "--cached", "--name-only"], { cwd: root, timeout: 3e4 })).stdout.trim();
-  if (!staged) {
-    emit("commit", "Nothing to commit \u2014 skipping the pull request.");
-    return;
-  }
-  const commitArgs = ["commit", "-m", "chore: scaffold project (4PM)"];
+function errText(err) {
+  const e = err;
+  const raw = (e?.stderr || e?.message || String(err)).trim();
+  return raw.split("\n").filter(Boolean).slice(-3).join(" ").slice(0, 500);
+}
+async function gitOut(cwd2, args) {
   try {
-    await run("git", commitArgs, { cwd: root, timeout: 6e4 });
+    return (await run("git", args, { cwd: cwd2, timeout: 3e4 })).stdout.trim();
   } catch {
-    await run("git", ["-c", "user.name=4PM", "-c", "user.email=noreply@4pm.app", ...commitArgs], { cwd: root, timeout: 6e4 });
+    return "";
   }
-  const branch = (repo.branch ?? "").trim();
+}
+async function commitAndOpenPr(root, repo, emit) {
+  const result = { committed: false, pushed: false, branch: null, prUrl: null, step: null, error: null };
+  const fail = (step, error) => {
+    result.step = step;
+    result.error = error;
+    return result;
+  };
+  emit("commit", "Committing the scaffolded project\u2026");
+  try {
+    await run("git", ["add", "-A"], { cwd: root, timeout: 6e4 });
+    const staged = (await run("git", ["diff", "--cached", "--name-only"], { cwd: root, timeout: 3e4 })).stdout.trim();
+    if (staged) {
+      const commitArgs = ["commit", "-m", "chore: scaffold project (4PM)"];
+      try {
+        await run("git", commitArgs, { cwd: root, timeout: 6e4 });
+      } catch {
+        await run("git", ["-c", "user.name=4PM", "-c", "user.email=noreply@4pm.app", ...commitArgs], { cwd: root, timeout: 6e4 });
+      }
+    } else {
+      emit("commit", "Nothing new to commit.");
+    }
+  } catch (err) {
+    const msg = errText(err);
+    emit("commit-failed", `Could not commit the scaffold: ${msg}`);
+    return fail("commit", msg);
+  }
+  result.committed = !!await gitOut(root, ["rev-parse", "--verify", "HEAD"]);
+  const declared = (repo.branch ?? "").trim();
+  const head = await gitOut(root, ["rev-parse", "--abbrev-ref", "HEAD"]);
+  const branch = declared || (head && head !== "HEAD" ? head : "");
+  result.branch = branch || null;
   emit("push", "Pushing the scaffold branch\u2026");
   try {
-    await run("git", ["push", "-u", "origin", ...branch ? [branch] : ["HEAD"]], { cwd: root, timeout: 12e4 });
+    await run("git", ["push", "-u", "origin", branch || "HEAD"], { cwd: root, timeout: 12e4 });
+    result.pushed = true;
   } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    emit("push-failed", `Scaffold committed locally but the push failed: ${msg} \u2014 push it from the Git tab when credentials are available.`);
-    return;
+    const msg = errText(err);
+    emit("push-failed", `Scaffold committed locally but the push failed: ${msg} \u2014 retry from the project page when credentials are available.`);
+    return fail("push", msg);
   }
-  const { provider, slug } = providerSlug(repo.url ?? "");
+  const remoteHead = (await gitOut(root, ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"])).replace(/^origin\//, "");
+  if (branch && remoteHead && branch === remoteHead) {
+    emit("pr", `Pushed to the default branch (${branch}) \u2014 no pull request needed.`);
+    return result;
+  }
+  const url = (repo.url ?? "").trim() || await gitOut(root, ["remote", "get-url", "origin"]);
+  const { provider, slug } = providerSlug(url);
   if (!provider) {
     emit("pr", "Unknown git host \u2014 skipping the pull request.");
-    return;
+    return result;
   }
   emit("pr", `Opening a pull request via ${provider}\u2026`);
   try {
-    const args = provider === "glab" ? ["mr", "create", "--fill", ...slug ? ["-R", slug] : []] : ["pr", "create", "--fill", ...slug ? ["-R", slug] : []];
+    const args = provider === "glab" ? ["mr", "create", "--fill", "--yes", ...branch ? ["--source-branch", branch] : [], ...slug ? ["-R", slug] : []] : ["pr", "create", "--fill", ...branch ? ["--head", branch] : [], ...slug ? ["-R", slug] : []];
     const { stdout } = await run(provider, args, { cwd: root, timeout: 12e4 });
-    const link2 = stdout.trim().split(/\s+/).find((s3) => /^https?:\/\//.test(s3)) ?? stdout.trim().split("\n").pop() ?? "";
+    const link2 = stdout.trim().split(/\s+/).find((x) => /^https?:\/\//.test(x)) ?? null;
+    result.prUrl = link2;
     emit("pr", `Pull request opened${link2 ? `: ${link2}` : "."}`);
+    return result;
   } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
+    const msg = errText(err);
+    const existing = /already exists/i.test(msg) ? msg.match(/https?:\/\/\S+/)?.[0] ?? null : null;
+    if (existing) {
+      result.prUrl = existing;
+      emit("pr", `A pull request is already open: ${existing}`);
+      return result;
+    }
     emit("pr-failed", `Could not open a pull request (${provider}): ${msg}`);
+    return fail("pr", msg);
   }
 }
+async function publishScaffold(root, emit) {
+  let repo = {};
+  try {
+    const spec = JSON.parse(await readFile(join6(root, "project.spec.json"), "utf8"));
+    repo = singleRepo(reposOf(spec)) ?? {};
+  } catch {
+  }
+  return commitAndOpenPr(root, repo, emit);
+}
 function cloneArgs(url, dest, branch) {
   const b2 = (branch ?? "").trim();
   return b2 ? ["clone", "-b", b2, url, dest] : ["clone", url, dest];
@@ -37802,7 +37944,7 @@ function sampleDir() {
   }
   return bundled;
 }
-async function scaffoldProject(payload, profileDir2, onProgress, ai2) {
+async function scaffoldProject(payload, profileDir2, onProgress, ai2, applyGitAuth2) {
   let lastStep = "start";
   const emit = (step, message) => {
     lastStep = step;
@@ -37814,15 +37956,16 @@ async function scaffoldProject(payload, profileDir2, onProgress, ai2) {
     await mkdir(target, { recursive: true });
     const repo = singleRepo(reposOf(payload.spec));
     if (!repo) throw new Error("A project must declare one repo (ADR-0314).");
+    if (payload.gitAuth !== void 0) applyGitAuth2?.(payload.gitAuth ?? null, payload.gitAuthHost ?? null);
     emit("git", "Cloning repository\u2026");
     await provisionRepo(target, repo, emit, { createMissingBranch: true });
     await scaffoldRepo(target, payload.projectName, payload.spec, emit, { resetClaude: true, ai: ai2 });
     await attachSubmodules(target, submodulesOf(reposOf(payload.spec)), emit, true);
     emit("version", "Writing .4pm/.4pm.json\u2026");
     await writeTemplateMarker(target);
-    await commitAndOpenPr(target, repo, emit);
+    const publish = await commitAndOpenPr(target, repo, emit);
     onProgress?.({ projectId: payload.projectId, step: "done", message: "Scaffold complete.", done: true });
-    return { ok: true, path: target };
+    return { ok: true, path: target, publish };
   } catch (err) {
     return { ok: false, error: err instanceof Error ? err.message : String(err), step: lastStep };
   }
@@ -37956,7 +38099,7 @@ async function addProject(payload, profileDir2, onProgress, ai2) {
 }
 
 // src/core/worker-metrics.ts
-import { statfs, readFile } from "fs/promises";
+import { statfs, readFile as readFile2 } from "fs/promises";
 import { existsSync as existsSync5 } from "fs";
 import { totalmem, freemem, cpus, platform, arch } from "os";
 var CGROUP = "/sys/fs/cgroup";
@@ -37964,7 +38107,7 @@ var MB = 1024 * 1024;
 var GB = 1024 * 1024 * 1024;
 async function readCgroup(file) {
   try {
-    return (await readFile(`${CGROUP}/${file}`, "utf8")).trim();
+    return (await readFile2(`${CGROUP}/${file}`, "utf8")).trim();
   } catch {
     return null;
   }
@@ -38326,9 +38469,15 @@ var WsChannels = {
   // cli → server (reply): a short-lived GitHub-App installation token for the served project's repo,
   // per job scope; also the cli's "scope revoked" report (ADR-0356). The App key stays on the server.
   GIT_TOKEN: "git.token",
+  // cli → server (one-way): the worker's per-repo git state of the served project (ADR-0369) — head,
+  // branches + tracking, remote, dirty, worker-only commits, origin window. Latest kept per physic × repo.
+  GIT_SNAPSHOT: "git.snapshot",
   PROJECT_CREATE: "project.create",
   PROJECT_ADD: "project.add",
   PROJECT_PROGRESS: "project.progress",
+  // server → cli (reply): retry the scaffold commit → push → PR in the project folder (ADR-0368,
+  // project-0074); the reply carries the new outcome, stored on `projects.scaffold_publish`.
+  PROJECT_PUBLISH: "project.publish",
   // server → cli: keep the physic folder name in sync with the project (folder =
   // project name — ADR-0064) when the project is renamed.
   PHYSIC_SYNC: "physic.sync",
@@ -38370,6 +38519,9 @@ var WsChannels = {
   QUOTA_CHECK: "quota.check",
   // cli → server (reply): per-org concurrent AI-run slot — acquire / renew / release (ADR-0359)
   RUN_SLOT: "run.slot",
+  // cli → server (reply): read / add the org's monthly autonomous-book counters — USER_TODO / USER_QA /
+  // AI_TODO rows vs `autonomousRequestsPerMonth` (ADR-0365)
+  AUTONOMOUS_BOOK_USAGE: "autonomous.bookUsage",
   USAGE_REPORT: "usage.report",
   // cli → server: Claude subscription usage snapshot (5h / weekly — ADR-0072)
   MACHINE_USAGE: "machine.usage",
@@ -38590,8 +38742,8 @@ function resolveInstallTimeoutMs(sec) {
   return sec && sec > 0 ? sec * 1e3 : TOOL_INSTALL_TIMEOUT_DEFAULT_MS;
 }
 function sleep(ms2) {
-  return new Promise((resolve12) => {
-    const t2 = setTimeout(resolve12, ms2);
+  return new Promise((resolve13) => {
+    const t2 = setTimeout(resolve13, ms2);
     t2.unref?.();
   });
 }
@@ -38619,14 +38771,14 @@ function classifyToolFailure(code, out) {
   return { reason: "other", retryable: false };
 }
 function run2(cmd, args, onLine, timeoutMs = 18e4) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     let out = "";
     let buf = "";
     let child = null;
     const done = (code) => {
       clearTimeout(timer);
       if (onLine && buf.trim()) onLine(buf.trim());
-      resolve12({ code, out });
+      resolve13({ code, out });
     };
     const timer = setTimeout(() => {
       child?.kill();
@@ -39009,11 +39161,11 @@ function getWorkingProfile(profileDir2, cmd) {
   return readState(profileDir2)[cmd] ?? null;
 }
 function setWorkingProfile(profileDir2, cmd, dir2) {
-  const state2 = readState(profileDir2);
-  if (state2[cmd] === dir2) return;
-  state2[cmd] = dir2;
+  const state3 = readState(profileDir2);
+  if (state3[cmd] === dir2) return;
+  state3[cmd] = dir2;
   try {
-    writeFileSync4(statePath(profileDir2), JSON.stringify(state2, null, 2), "utf8");
+    writeFileSync4(statePath(profileDir2), JSON.stringify(state3, null, 2), "utf8");
   } catch {
   }
 }
@@ -39022,11 +39174,11 @@ function getWorkingCredential(profileDir2) {
   return readState(profileDir2)[WORKING_CREDENTIAL_KEY] ?? null;
 }
 function setWorkingCredential(profileDir2, key) {
-  const state2 = readState(profileDir2);
-  if (state2[WORKING_CREDENTIAL_KEY] === key) return;
-  state2[WORKING_CREDENTIAL_KEY] = key;
+  const state3 = readState(profileDir2);
+  if (state3[WORKING_CREDENTIAL_KEY] === key) return;
+  state3[WORKING_CREDENTIAL_KEY] = key;
   try {
-    writeFileSync4(statePath(profileDir2), JSON.stringify(state2, null, 2), "utf8");
+    writeFileSync4(statePath(profileDir2), JSON.stringify(state3, null, 2), "utf8");
   } catch {
   }
 }
@@ -39035,20 +39187,20 @@ function getPinnedCredential(profileDir2) {
   return readState(profileDir2)[PINNED_CREDENTIAL_KEY] ?? null;
 }
 function setPinnedCredential(profileDir2, key) {
-  const state2 = readState(profileDir2);
-  if (state2[PINNED_CREDENTIAL_KEY] === key) return;
-  state2[PINNED_CREDENTIAL_KEY] = key;
+  const state3 = readState(profileDir2);
+  if (state3[PINNED_CREDENTIAL_KEY] === key) return;
+  state3[PINNED_CREDENTIAL_KEY] = key;
   try {
-    writeFileSync4(statePath(profileDir2), JSON.stringify(state2, null, 2), "utf8");
+    writeFileSync4(statePath(profileDir2), JSON.stringify(state3, null, 2), "utf8");
   } catch {
   }
 }
 function clearPinnedCredential(profileDir2) {
-  const state2 = readState(profileDir2);
-  if (!(PINNED_CREDENTIAL_KEY in state2)) return;
-  delete state2[PINNED_CREDENTIAL_KEY];
+  const state3 = readState(profileDir2);
+  if (!(PINNED_CREDENTIAL_KEY in state3)) return;
+  delete state3[PINNED_CREDENTIAL_KEY];
   try {
-    writeFileSync4(statePath(profileDir2), JSON.stringify(state2, null, 2), "utf8");
+    writeFileSync4(statePath(profileDir2), JSON.stringify(state3, null, 2), "utf8");
   } catch {
   }
 }
@@ -39433,16 +39585,16 @@ async function fetchUsage(token) {
   }
 }
 function runUsageCli(dir2, aiCli2) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     let out = "";
     let child = null;
     const finish = () => {
       clearTimeout(timer);
-      resolve12(out);
+      resolve13(out);
     };
     const timer = setTimeout(() => {
       child?.kill();
-      resolve12(out);
+      resolve13(out);
     }, 3e4);
     timer.unref?.();
     try {
@@ -40138,7 +40290,7 @@ function parseModeratedAnswer(text) {
   return { body: text.trim() };
 }
 function runClaudeOnce(cmd, profile, prompt, extraEnv, imageDir, denyDirs = [], timeoutMs = ANSWER_TIMEOUT_MS) {
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     const isClaude = cmd.includes("claude");
     const args = [
       "-p",
@@ -40182,7 +40334,7 @@ function runClaudeOnce(cmd, profile, prompt, extraEnv, imageDir, denyDirs = [],
       clearTimeout(timer);
       cleanup();
       out += parser.flush();
-      resolve12({ code: code ?? -1, out, err, usage: parser.usage() });
+      resolve13({ code: code ?? -1, out, err, usage: parser.usage() });
     });
     child.stdin.write(prompt);
     child.stdin.end();
@@ -40273,14 +40425,14 @@ function reportToolResult(tool, ok, message) {
 }
 
 // src/core/autonomous.ts
-import { readFile as readFile4, writeFile as writeFile4, chmod } from "fs/promises";
+import { readFile as readFile5, writeFile as writeFile4, chmod } from "fs/promises";
 import { readFileSync as readFileSync14 } from "fs";
 import { execFile as execFile3, spawn as spawn5 } from "child_process";
 import { join as join17 } from "path";
 import { promisify as promisify3 } from "util";
 
 // src/core/autonomous-config.ts
-import { readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import { readFile as readFile3, writeFile as writeFile2 } from "fs/promises";
 import { readFileSync as readFileSync13 } from "fs";
 import { join as join15 } from "path";
 var DEFAULT_AUTONOMOUS_CONFIG = {
@@ -40316,7 +40468,7 @@ function coerce2(raw) {
 }
 async function readAutonomousConfig(profileDir2) {
   try {
-    return coerce2(JSON.parse(await readFile2(autonomousConfigPath(profileDir2), "utf8")));
+    return coerce2(JSON.parse(await readFile3(autonomousConfigPath(profileDir2), "utf8")));
   } catch {
     return { ...DEFAULT_AUTONOMOUS_CONFIG };
   }
@@ -40330,7 +40482,7 @@ function readAutonomousConfigSync(profileDir2) {
 }
 async function readAutonomousConfigText(profileDir2) {
   try {
-    return await readFile2(autonomousConfigPath(profileDir2), "utf8");
+    return await readFile3(autonomousConfigPath(profileDir2), "utf8");
   } catch {
     return JSON.stringify(DEFAULT_AUTONOMOUS_CONFIG, null, 2) + "\n";
   }
@@ -40350,7 +40502,7 @@ function isInQuietHours(quietHours, now = /* @__PURE__ */ new Date()) {
 }
 
 // src/core/autonomous-history.ts
-import { readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
+import { readFile as readFile4, writeFile as writeFile3 } from "fs/promises";
 import { join as join16 } from "path";
 var HISTORIES_REL = ".claude/.autonomous.histories.json";
 var MAX_RECORDS = 50;
@@ -40360,7 +40512,7 @@ function historiesPath(root) {
 }
 async function readHistories(root) {
   try {
-    const d = JSON.parse(await readFile3(historiesPath(root), "utf8"));
+    const d = JSON.parse(await readFile4(historiesPath(root), "utf8"));
     const ticks = d.ticks ?? {};
     return {
       cronApplied: typeof d.cronApplied === "string" ? d.cronApplied : typeof d.cron_applied === "string" ? d.cron_applied : "",
@@ -40402,7 +40554,7 @@ var BOOK_FILES = {
 };
 async function readText(path, fallback = "") {
   try {
-    return await readFile4(path, "utf8");
+    return await readFile5(path, "utf8");
   } catch {
     return fallback;
   }
@@ -40447,6 +40599,14 @@ function tableRowsById(md) {
   }
   return rows;
 }
+var CAPPED_BOOK_FILES = { USER_TODO: "USER_TODO.md", USER_QA: "USER_QA.md", AI_TODO: "AI_TODO.md" };
+async function cappedBookIds(root) {
+  const out = {};
+  for (const [book, file] of Object.entries(CAPPED_BOOK_FILES)) {
+    out[book] = new Set(tableRowsById(await readText(join17(root, file))).keys());
+  }
+  return out;
+}
 function tickScript(root) {
   return join17(root, TICK_REL);
 }
@@ -40459,10 +40619,10 @@ async function crontabList() {
   }
 }
 async function crontabSet(content) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     const child = spawn5("crontab", ["-"], { stdio: ["pipe", "ignore", "ignore"] });
-    child.on("error", () => resolve12(false));
-    child.on("close", (code) => resolve12(code === 0));
+    child.on("error", () => resolve13(false));
+    child.on("close", (code) => resolve13(code === 0));
     child.stdin.end(content.endsWith("\n") ? content : content + "\n");
   });
 }
@@ -40538,6 +40698,7 @@ async function uninstallCron(root) {
   await crontabSet(kept.join("\n"));
 }
 async function writeAutonomous(root, profileDir2, req, by) {
+  let added;
   try {
     switch (req.kind) {
       case "settings": {
@@ -40582,6 +40743,7 @@ async function writeAutonomous(root, profileDir2, req, by) {
         const row = `| ${id} | | | ${tableCell(req.content)} |
 `;
         await writeFile4(join17(root, BOOK_FILES.userTodo), cur.replace(/\s*$/, "\n") + row, "utf8");
+        added = 1;
         const authors = await readJsonMap(join17(root, AUTHORS_REL));
         authors[id] = { by, byLabel: req.byLabel ?? by, at: (/* @__PURE__ */ new Date()).toISOString() };
         await writeFile4(join17(root, AUTHORS_REL), JSON.stringify(authors, null, 2) + "\n", "utf8");
@@ -40594,8 +40756,10 @@ async function writeAutonomous(root, profileDir2, req, by) {
         const authors = await readJsonMap(join17(root, AUTHORS_REL));
         const at2 = (/* @__PURE__ */ new Date()).toISOString();
         const byLabel = req.byLabel ?? by;
+        added = 0;
         for (const [id, cells] of next) {
           if (prev.get(id) !== cells) authors[id] = { by, byLabel, at: at2 };
+          if (!prev.has(id)) added += 1;
         }
         await writeFile4(join17(root, file), req.content, "utf8");
         await writeFile4(join17(root, AUTHORS_REL), JSON.stringify(authors, null, 2) + "\n", "utf8");
@@ -40607,7 +40771,7 @@ async function writeAutonomous(root, profileDir2, req, by) {
         break;
       }
     }
-    return { ok: true, status: await getAutonomousStatus(root, profileDir2) };
+    return { ok: true, status: await getAutonomousStatus(root, profileDir2), ...added !== void 0 ? { added } : {} };
   } catch (err) {
     return { ok: false, error: err instanceof Error ? err.message : String(err) };
   }
@@ -40631,14 +40795,14 @@ function detectContainerized() {
   }
 }
 function canReach(host, port) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     const socket = connect({ host, port });
     let done = false;
     const finish = (ok) => {
       if (done) return;
       done = true;
       socket.destroy();
-      resolve12(ok);
+      resolve13(ok);
     };
     socket.setTimeout(PROBE_TIMEOUT_MS);
     socket.once("connect", () => finish(true));
@@ -40823,7 +40987,7 @@ async function issueGitToken(scope, host, path) {
   }
 }
 function revokeAtGithub(t2) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     try {
       const req = httpsRequest(
         new URL(`${t2.apiBase.replace(/\/+$/, "")}/installation/token`),
@@ -40834,14 +40998,14 @@ function revokeAtGithub(t2) {
         },
         (res) => {
           res.resume();
-          res.on("end", () => resolve12());
+          res.on("end", () => resolve13());
         }
       );
       req.on("timeout", () => req.destroy());
-      req.on("error", () => resolve12());
+      req.on("error", () => resolve13());
       req.end();
     } catch {
-      resolve12();
+      resolve13();
     }
   });
 }
@@ -40863,26 +41027,113 @@ async function revokeAll() {
   await Promise.all([...state.scopes.keys()].map((s3) => endGitScope(s3)));
 }
 
-// src/core/ws-client/transcript.ts
-function toDtoEntry(e) {
-  return {
-    id: e.id,
-    source: e.source,
-    kind: e.kind,
-    text: e.text,
-    level: e.level,
-    resultKind: e.resultKind,
-    // Processing time on a terminal `exit` entry (ADR-0249) — the web renders it inline.
-    ...e.durationMs != null ? { durationMs: e.durationMs } : {},
-    // AI-run metadata on an `aireq` marker — powers the web's clickable CLI name → details modal.
-    ...e.aiMeta ? { aiMeta: e.aiMeta } : {}
-  };
+// src/core/git-snapshot.ts
+import { execFile as execFile6 } from "child_process";
+import { stat } from "fs/promises";
+import { join as join20, resolve as resolve5 } from "path";
+import { promisify as promisify6 } from "util";
+
+// src/core/git-history.ts
+import { execFile as execFile4 } from "child_process";
+import { resolve as resolve4, sep as sep2 } from "path";
+import { promisify as promisify4 } from "util";
+var run4 = promisify4(execFile4);
+var FS = "";
+var RS = "";
+function resolveRepo(root, repo) {
+  if (!root) return null;
+  const base = resolve4(root);
+  const requested = resolve4(base, repo && repo.trim() ? repo : ".");
+  return requested === base || requested.startsWith(base + sep2) ? requested : base;
 }
-function envReconnectMaxSec() {
-  const raw = Number(process.env.FOURPM_RECONNECT_MAX_BACKOFF_SEC);
-  if (!Number.isFinite(raw)) return null;
-  const { min, max } = CLI_SETTINGS_BOUNDS.reconnectMaxBackoffSec;
-  return Math.min(Math.max(Math.floor(raw), min), max);
+async function git(cwd2, args) {
+  try {
+    const { stdout } = await run4("git", args, {
+      cwd: cwd2,
+      timeout: 15e3,
+      maxBuffer: 8 * 1024 * 1024
+    });
+    return stdout;
+  } catch {
+    return "";
+  }
+}
+async function gitRepos(root) {
+  if (!root) return { repos: [] };
+  const base = resolve4(root);
+  const top = (await git(base, ["rev-parse", "--show-toplevel"])).trim();
+  if (!top || !(top === base || top.startsWith(base + sep2))) return { repos: [] };
+  const repos = [];
+  const rootRemote = (await git(base, ["remote", "get-url", "origin"])).trim();
+  const rootBranch = (await git(base, ["rev-parse", "--abbrev-ref", "HEAD"])).trim();
+  repos.push({ subdir: "", name: "", remote: rootRemote || null, branch: rootBranch || null });
+  const subOut = await git(base, ["submodule", "status"]);
+  for (const line of subOut.split("\n")) {
+    const m2 = line.trim().match(/^[-+U ]?[0-9a-f]{7,40}\s+(\S+)/);
+    const subPath = m2?.[1];
+    if (!subPath) continue;
+    const abs = resolve4(base, subPath);
+    if (!(abs === base || abs.startsWith(base + sep2))) continue;
+    const remote = (await git(abs, ["remote", "get-url", "origin"])).trim();
+    const branch = (await git(abs, ["rev-parse", "--abbrev-ref", "HEAD"])).trim();
+    repos.push({ subdir: subPath, name: subPath, remote: remote || null, branch: branch || null });
+  }
+  return { repos };
+}
+async function gitLog(root, repo, skip, limit) {
+  const cwd2 = resolveRepo(root, repo);
+  if (!cwd2) return { entries: [], hasMore: false };
+  const capped = Math.min(Math.max(limit, 1), 200);
+  const format = ["%H", "%h", "%an", "%aI", "%s"].join(FS) + RS;
+  const stdout = await git(cwd2, [
+    "log",
+    `--skip=${Math.max(skip, 0)}`,
+    `-n`,
+    String(capped + 1),
+    `--pretty=format:${format}`
+  ]);
+  const rows = stdout.split(RS).map((r) => r.replace(/^\n/, "")).filter((r) => r.length > 0);
+  const entries2 = rows.slice(0, capped).map((row) => {
+    const [hash = "", shortHash = "", author = "", date = "", subject = ""] = row.split(FS);
+    return { hash, shortHash, author, date, subject };
+  });
+  return { entries: entries2, hasMore: rows.length > capped };
+}
+async function gitCommit(root, repo, hash) {
+  const cwd2 = resolveRepo(root, repo);
+  const empty = { hash, author: "", date: "", subject: "", files: [] };
+  if (!cwd2 || !hash) return empty;
+  const format = ["%H", "%an", "%aI", "%s"].join(FS);
+  const stdout = await git(cwd2, [
+    "show",
+    "--name-status",
+    "-M",
+    `--pretty=format:${format}`,
+    hash
+  ]);
+  if (!stdout) return empty;
+  const lines = stdout.split("\n");
+  const [full = hash, author = "", date = "", subject = ""] = (lines[0] ?? "").split(FS);
+  const files = [];
+  for (const line of lines.slice(1)) {
+    if (!line.trim()) continue;
+    const parts = line.split("	");
+    const status = (parts[0] ?? "").charAt(0);
+    if (!status) continue;
+    if (status === "R" || status === "C") {
+      files.push({ path: parts[2] ?? "", status, oldPath: parts[1] ?? void 0 });
+    } else {
+      files.push({ path: parts[1] ?? "", status });
+    }
+  }
+  return { hash: full, author, date, subject, files };
+}
+async function gitCommitDiff(root, repo, hash, path) {
+  const cwd2 = resolveRepo(root, repo);
+  if (!cwd2 || !hash || !path) return { path, oldContent: "", newContent: "" };
+  const oldContent = await git(cwd2, ["show", `${hash}^:${path}`]);
+  const newContent = await git(cwd2, ["show", `${hash}:${path}`]);
+  return { path, oldContent, newContent };
 }
 
 // src/core/ws-client/command-dispatch.ts
@@ -40971,7 +41222,7 @@ async function runCommand(dispatch, emitRaw, opts) {
   });
   child.stdout?.on("data", (data) => batcher.push(data.toString("utf8")));
   child.stderr?.on("data", (data) => batcher.push(data.toString("utf8")));
-  await new Promise((resolve12) => {
+  await new Promise((resolve13) => {
     child.on("close", (exitCode) => {
       clearTimers();
       batcher.flush();
@@ -40985,7 +41236,7 @@ async function runCommand(dispatch, emitRaw, opts) {
         // note instead of spinning.
         exitCode: cancelled ? COMMAND_CANCELLED_EXIT_CODE : timedOut ? 124 : exitCode ?? -1
       });
-      resolve12();
+      resolve13();
     });
     child.on("error", (err) => {
       clearTimers();
@@ -40997,7 +41248,7 @@ async function runCommand(dispatch, emitRaw, opts) {
         done: true,
         exitCode: -1
       });
-      resolve12();
+      resolve13();
     });
   });
 }
@@ -41020,15 +41271,15 @@ function isOutOfCredits(text) {
   );
 }
 function runAttempt(commandId, cmd, args, stdin, cwd2, env3, onChunk, timeoutMs, signal) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     runCommand(
       { commandId, cmd, args, path: cwd2, env: env3 },
       (out) => {
         if (out.chunk) onChunk(out.chunk);
-        if (out.done) resolve12(out.exitCode ?? -1);
+        if (out.done) resolve13(out.exitCode ?? -1);
       },
       { stdin, ...timeoutMs > 0 ? { timeoutMs } : {}, ...signal ? { signal } : {} }
-    ).catch(() => resolve12(-1));
+    ).catch(() => resolve13(-1));
   });
 }
 async function runAiFailover(plan, commandId, cwd2, handlers, timeoutMs = 0, signal) {
@@ -41249,8 +41500,8 @@ function runHistory(ctx) {
   ctx.print(t("slash.history.header", { n: recent.length, total: all.length }));
   recent.forEach((e, i) => {
     const time = new Date(e.startedAt).toLocaleTimeString();
-    const state2 = e.status === "done" ? "\u2713" : e.status === "failed" ? `\u2717 exit ${e.exitCode}` : t("slash.history.running");
-    ctx.print(`  [${i + 1}] ${time}  ${commandLine(e.cmd, e.args)}  \xB7 ${state2}`);
+    const state3 = e.status === "done" ? "\u2713" : e.status === "failed" ? `\u2717 exit ${e.exitCode}` : t("slash.history.running");
+    ctx.print(`  [${i + 1}] ${time}  ${commandLine(e.cmd, e.args)}  \xB7 ${state3}`);
   });
 }
 function runOutput(ctx) {
@@ -41261,8 +41512,8 @@ function runOutput(ctx) {
     return;
   }
   const entry = all.slice().reverse()[n - 1];
-  const state2 = entry.exitCode != null ? ` (exit ${entry.exitCode})` : "";
-  ctx.print(t("slash.output.header", { n, cmd: commandLine(entry.cmd, entry.args), status: entry.status, state: state2 }));
+  const state3 = entry.exitCode != null ? ` (exit ${entry.exitCode})` : "";
+  ctx.print(t("slash.output.header", { n, cmd: commandLine(entry.cmd, entry.args), status: entry.status, state: state3 }));
   const out = readCommandOutput(entry.commandId);
   if (out == null) {
     ctx.print(t("slash.output.none"), "warn");
@@ -41557,7 +41808,7 @@ function buildPrompt2(input) {
   ].join("\n");
 }
 function runOnce(cmd, profile, prompt, cwd2, extraEnv, denyDirs = []) {
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     const args = [
       "-p",
       "--output-format",
@@ -41592,7 +41843,7 @@ function runOnce(cmd, profile, prompt, cwd2, extraEnv, denyDirs = []) {
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      resolve12({ code: code ?? -1, out, err });
+      resolve13({ code: code ?? -1, out, err });
     });
     child.stdin.write(prompt);
     child.stdin.end();
@@ -41619,13 +41870,13 @@ async function runMemoryCompaction(ai2, cwd2, input) {
 }
 
 // src/core/git-commit-identity.ts
-import { execFile as execFile4 } from "child_process";
-import { promisify as promisify4 } from "util";
-var run4 = promisify4(execFile4);
+import { execFile as execFile5 } from "child_process";
+import { promisify as promisify5 } from "util";
+var run5 = promisify5(execFile5);
 async function setCommitAuthor(cwd2, machineUsername) {
   if (!machineUsername) return;
   try {
-    await run4("git", ["config", "--local", "user.name", machineUsername], { cwd: cwd2, timeout: 8e3 });
+    await run5("git", ["config", "--local", "user.name", machineUsername], { cwd: cwd2, timeout: 8e3 });
   } catch {
   }
 }
@@ -41633,13 +41884,13 @@ async function setCommitAuthor(cwd2, machineUsername) {
 // src/core/ws-client/run-slot.ts
 var NO_SLOT = { release: () => void 0 };
 function sleep2(ms2, signal) {
-  return new Promise((resolve12) => {
-    if (signal?.aborted) return resolve12();
+  return new Promise((resolve13) => {
+    if (signal?.aborted) return resolve13();
     const timer = setTimeout(done, ms2);
     function done() {
       clearTimeout(timer);
       signal?.removeEventListener("abort", done);
-      resolve12();
+      resolve13();
     }
     signal?.addEventListener("abort", done, { once: true });
   });
@@ -41682,6 +41933,7 @@ async function acquireRunSlot(ctx, onQueued, signal) {
       }
       return { kind: "granted", handle, queued: ticket !== void 0 };
     }
+    if ("denied" in reply) return { kind: "denied", reason: reply.denied };
     ticket = reply.ticket;
     limit = reply.limit;
     if (reply.position !== lastPosition) {
@@ -41700,11 +41952,41 @@ function leaveQueue(ctx, ticket) {
 // src/core/ws-client/command-dispatch.ts
 var MEMORY_SEED_HEADER = "CONTEXT MEMORY from earlier in this conversation (may span prior sessions/accounts). Use it as background; do not repeat it back unless relevant:";
 var activeRuns = /* @__PURE__ */ new Map();
+var GIT_STATE_SUBCOMMANDS = /* @__PURE__ */ new Set([
+  "add",
+  "branch",
+  "checkout",
+  "cherry-pick",
+  "commit",
+  "fetch",
+  "merge",
+  "pull",
+  "push",
+  "rebase",
+  "reset",
+  "restore",
+  "revert",
+  "rm",
+  "stash",
+  "switch",
+  "tag",
+  "mv"
+]);
+function changesGitState(cmd, args) {
+  if (cmd === "gh" || cmd === "glab") return args.includes("create") || args.includes("merge");
+  if (cmd !== "git") return false;
+  let i = 0;
+  while (args[i] === "-C" || args[i] === "-c") i += 2;
+  return GIT_STATE_SUBCOMMANDS.has(args[i] ?? "");
+}
+function activeAiRunCount() {
+  return activeRuns.size;
+}
 function cancelActiveRun(commandId) {
-  const run11 = activeRuns.get(commandId);
-  if (!run11) return { ok: false, state: "unknown" };
-  run11.controller.abort();
-  return { ok: true, state: run11.state };
+  const run12 = activeRuns.get(commandId);
+  if (!run12) return { ok: false, state: "unknown" };
+  run12.controller.abort();
+  return { ok: true, state: run12.state };
 }
 function handleCommandChannels(ctx, message, payload) {
   if (message.channel === WsChannels.COMMAND_CANCEL) {
@@ -41769,6 +42051,7 @@ function handleCommandChannels(ctx, message, payload) {
       ctx.bus.endBusy(dispatch.cmd);
       const code = out.exitCode ?? -1;
       finishCommand(out.commandId, code);
+      if (changesGitState(dispatch.cmd, dispatch.args)) requestGitSnapshot("git-write");
       ctx.bus.push({
         source: "server",
         kind: "exit",
@@ -41800,15 +42083,16 @@ async function runLocalCommand(ctx, input) {
   await runAiPrompt(ctx, prompt, commandId, "local");
 }
 async function runAiPrompt(ctx, prompt, commandId, origin, oneShot = false, images, aiConfig, readOnly = false, bypass = false) {
-  const run11 = { controller: new AbortController(), state: "queued" };
-  activeRuns.set(commandId, run11);
+  const run12 = { controller: new AbortController(), state: "queued" };
+  activeRuns.set(commandId, run12);
   try {
-    await runAiPromptInner(ctx, prompt, commandId, origin, run11, oneShot, images, aiConfig, readOnly, bypass);
+    await runAiPromptInner(ctx, prompt, commandId, origin, run12, oneShot, images, aiConfig, readOnly, bypass);
   } finally {
     activeRuns.delete(commandId);
+    if (!readOnly) requestGitSnapshot("ai-run");
   }
 }
-async function runAiPromptInner(ctx, prompt, commandId, origin, run11, oneShot = false, images, aiConfig, readOnly = false, bypass = false) {
+async function runAiPromptInner(ctx, prompt, commandId, origin, run12, oneShot = false, images, aiConfig, readOnly = false, bypass = false) {
   const config = readProfileConfig(ctx.profileDir);
   const projectTimeoutSec = config.projectAiRunTimeoutSec ?? 0;
   const machineTimeoutSec = config.aiRunTimeoutSec ?? 0;
@@ -41989,13 +42273,20 @@ ${guardedPrompt}`;
           queue: { position, limit, running: running2 }
         });
       },
-      run11.controller.signal
+      run12.controller.signal
     );
     if (slot.kind === "timeout") {
       neverStarted = true;
       const text = `RUN_QUEUE_TIMEOUT: waited 30 min for a free run slot (plan limit ${slot.limit} parallel runs) \u2014 not run`;
       ctx.bus.push({ source: origin, kind: "log", text, level: "warn" });
       ctx.send(WsChannels.COMMAND_OUTPUT, { commandId, seq: seq++, chunk: `${text}
+`, log: true });
+      result = { exitCode: 1, workedDir: null, workedKey: null, workedCmd: null, usage: { tokens: 0, input: 0, output: 0, cacheRead: 0, cacheCreation: 0 }, sessionId: "" };
+    } else if (slot.kind === "denied") {
+      neverStarted = true;
+      const text = "STORAGE_QUOTA_EXCEEDED: the organization's hosted storage is full \u2014 clear storage in Settings \u203A Storage, then retry";
+      ctx.bus.push({ source: origin, kind: "log", text, level: "warn" });
+      ctx.send(WsChannels.COMMAND_OUTPUT, { commandId, seq: seq++, chunk: `${text}
 `, log: true });
       result = { exitCode: 1, workedDir: null, workedKey: null, workedCmd: null, usage: { tokens: 0, input: 0, output: 0, cacheRead: 0, cacheCreation: 0 }, sessionId: "" };
     } else if (slot.kind === "cancelled") {
@@ -42003,9 +42294,9 @@ ${guardedPrompt}`;
       result = { exitCode: COMMAND_CANCELLED_EXIT_CODE, workedDir: null, workedKey: null, workedCmd: null, usage: { tokens: 0, input: 0, output: 0, cacheRead: 0, cacheCreation: 0 }, sessionId: "", cancelled: true };
     } else {
       if (slot.queued) ctx.send(WsChannels.COMMAND_OUTPUT, { commandId, seq: seq++, chunk: "", log: true, queue: null });
-      run11.state = "running";
+      run12.state = "running";
       try {
-        result = await runAiFailover(plan, commandId, cwd2, handlers, aiRunTimeoutMs, run11.controller.signal);
+        result = await runAiFailover(plan, commandId, cwd2, handlers, aiRunTimeoutMs, run12.controller.signal);
       } finally {
         slot.handle.release();
       }
@@ -42316,16 +42607,211 @@ function rejectByReview(ctx, commandId, origin, prompt, reasons) {
   });
 }
 
+// src/core/git-snapshot.ts
+var run6 = promisify6(execFile6);
+var US = "";
+var RS2 = "";
+var MIN_SPACING_MS = 15e3;
+var DEFAULT_INTERVAL_MIN = 10;
+async function git2(cwd2, args, timeout = 2e4) {
+  try {
+    const { stdout } = await run6("git", args, { cwd: cwd2, timeout, maxBuffer: 16 * 1024 * 1024 });
+    return stdout;
+  } catch {
+    return "";
+  }
+}
+function parseTrack(track) {
+  const ahead = /ahead (\d+)/.exec(track)?.[1];
+  const behind = /behind (\d+)/.exec(track)?.[1];
+  return { ahead: ahead ? Number(ahead) : 0, behind: behind ? Number(behind) : 0 };
+}
+function parseStatus(out) {
+  const dirty = { staged: 0, unstaged: 0, untracked: 0, conflicted: 0 };
+  const files = [];
+  for (const line of out.split("\n")) {
+    if (!line || line.startsWith("#")) continue;
+    const kind = line[0];
+    if (kind === "?") {
+      dirty.untracked++;
+      files.push({ status: "?", path: line.slice(2) });
+    } else if (kind === "u") {
+      dirty.conflicted++;
+      files.push({ status: "U", path: line.split(" ").slice(10).join(" ") });
+    } else if (kind === "1" || kind === "2") {
+      const xy = line.slice(2, 4);
+      const x = xy[0] ?? ".";
+      const y = xy[1] ?? ".";
+      if (x !== ".") dirty.staged++;
+      if (y !== ".") dirty.unstaged++;
+      const parts = line.split(" ");
+      const path = (kind === "1" ? parts.slice(8) : parts.slice(9)).join(" ").split("	")[0] ?? "";
+      files.push({ status: y !== "." ? y : x, path });
+    }
+  }
+  return { dirty, files };
+}
+function parseLog(out, withFiles) {
+  const commits = [];
+  for (const rec of out.split(RS2)) {
+    if (!rec.trim()) continue;
+    const [header = "", ...rest] = rec.split("\n");
+    const [sha = "", parents = "", author = "", date = "", subject = ""] = header.split(US);
+    if (!sha) continue;
+    const files = withFiles ? rest.map((l) => l.trim()).filter(Boolean).map((l) => {
+      const cols = l.split("	");
+      return { status: (cols[0] ?? "M").charAt(0), path: cols[cols.length - 1] ?? "" };
+    }) : [];
+    commits.push({ sha, parents: parents.split(" ").filter(Boolean), author, date, subject, files });
+  }
+  return commits;
+}
+async function buildRepoSnapshot(dir2, subdir) {
+  const L2 = GIT_SNAPSHOT_LIMITS;
+  const fmt = `--format=${RS2}%H${US}%P${US}%an${US}%aI${US}%s`;
+  const [abbrev, headSha, heads, remotes, remoteHead, status, gitDir] = await Promise.all([
+    git2(dir2, ["rev-parse", "--abbrev-ref", "HEAD"]),
+    git2(dir2, ["rev-parse", "--verify", "HEAD"]),
+    git2(dir2, ["for-each-ref", "refs/heads", `--format=%(refname:short)${US}%(objectname)${US}%(upstream:short)${US}%(upstream:track,nobracket)`]),
+    git2(dir2, ["for-each-ref", "refs/remotes/origin", `--format=%(refname:short)${US}%(objectname)${US}%(symref)`]),
+    git2(dir2, ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"]),
+    git2(dir2, ["status", "--porcelain=v2", "--untracked-files=all"]),
+    git2(dir2, ["rev-parse", "--absolute-git-dir"])
+  ]);
+  const branchName = abbrev.trim();
+  const detached = branchName === "HEAD";
+  const branches = heads.split("\n").filter(Boolean).map((l) => {
+    const [name = "", sha = "", upstream2 = "", track = ""] = l.split(US);
+    return { name, sha, upstream: upstream2 || null, ...parseTrack(track) };
+  });
+  const remoteBranches = remotes.split("\n").filter(Boolean).map((l) => l.split(US)).filter(([, , symref]) => !symref).map(([name = "", sha = ""]) => ({ name: name.replace(/^origin\//, ""), sha })).filter((b2) => b2.name && b2.name !== "origin");
+  const { dirty, files } = parseStatus(status);
+  const [localOut, remoteOut] = await Promise.all([
+    git2(dir2, ["log", "--branches", "--not", "--remotes", "-n", String(L2.localCommits + 1), "--name-status", fmt], 3e4),
+    git2(dir2, ["log", "--remotes", "--date-order", "-n", String(L2.remoteCommits), fmt], 3e4)
+  ]);
+  const localAll = parseLog(localOut, true);
+  const localCommits = localAll.slice(0, L2.localCommits).map((c) => ({
+    ...c,
+    branches: branches.filter((b2) => b2.sha === c.sha).map((b2) => b2.name),
+    files: c.files.slice(0, L2.filesPerCommit),
+    filesTruncated: c.files.length > L2.filesPerCommit
+  }));
+  const remoteCommits = parseLog(remoteOut, false).map(({ files: _f, ...c }) => c);
+  const defaultBranch = remoteHead.trim().replace(/^origin\//, "") || null;
+  const upstream = branches.find((b2) => b2.name === branchName)?.upstream;
+  const baseRef = upstream ?? (defaultBranch ? `origin/${defaultBranch}` : null);
+  const baseSha = headSha.trim() && baseRef ? (await git2(dir2, ["merge-base", "HEAD", baseRef])).trim() || null : null;
+  let lastFetchAt = null;
+  try {
+    if (gitDir.trim()) lastFetchAt = (await stat(join20(gitDir.trim(), "FETCH_HEAD"))).mtime.toISOString();
+  } catch {
+    lastFetchAt = null;
+  }
+  return {
+    subdir,
+    head: { branch: detached || !branchName ? null : branchName, sha: headSha.trim() || null, detached },
+    branches,
+    remote: { name: "origin", defaultBranch, branches: remoteBranches },
+    dirty,
+    dirtyFiles: files.slice(0, L2.dirtyFiles),
+    dirtyTruncated: files.length > L2.dirtyFiles,
+    localCommits,
+    localTruncated: localAll.length > L2.localCommits,
+    remoteCommits,
+    baseSha,
+    lastFetchAt
+  };
+}
+async function buildGitSnapshot(root) {
+  const base = resolve5(root);
+  const { repos } = await gitRepos(base);
+  const snaps = await Promise.all(repos.map((r) => buildRepoSnapshot(r.subdir ? resolve5(base, r.subdir) : base, r.subdir)));
+  return { takenAt: (/* @__PURE__ */ new Date()).toISOString(), repos: snaps };
+}
+async function fetchAll(root) {
+  const base = resolve5(root);
+  const { repos } = await gitRepos(base);
+  for (const r of repos) await git2(r.subdir ? resolve5(base, r.subdir) : base, ["fetch", "--prune", "--quiet", "origin"], 6e4);
+}
+var state2 = { host: null, lastSentAt: 0, pending: null, periodic: null, running: false };
+async function reportNow(fetchFirst) {
+  const host = state2.host;
+  const root = host?.physicRoot;
+  if (!host || !root || state2.running || activeAiRunCount() > 0) return;
+  state2.running = true;
+  try {
+    if (fetchFirst) await fetchAll(root);
+    const payload = await buildGitSnapshot(root);
+    if (payload.repos.length === 0) return;
+    host.send(WsChannels.GIT_SNAPSHOT, payload);
+    state2.lastSentAt = Date.now();
+  } catch (err) {
+    logger.warn("git.snapshot.failed", { error: String(err) });
+  } finally {
+    state2.running = false;
+  }
+}
+function requestGitSnapshot(reason) {
+  if (!state2.host || state2.pending) return;
+  const wait = Math.max(0, state2.lastSentAt + MIN_SPACING_MS - Date.now());
+  state2.pending = setTimeout(() => {
+    state2.pending = null;
+    logger.debug("git.snapshot.request", { reason });
+    void reportNow(false);
+  }, wait || 1e3);
+  state2.pending.unref?.();
+}
+function startGitSnapshots(host) {
+  state2.host = host;
+  if (state2.periodic) clearInterval(state2.periodic);
+  state2.periodic = null;
+  const raw = readProfileConfig(host.profileDir).gitSnapshotIntervalMin;
+  const minutes = typeof raw === "number" && Number.isFinite(raw) && raw >= 0 ? raw : DEFAULT_INTERVAL_MIN;
+  if (minutes > 0) {
+    state2.periodic = setInterval(() => void reportNow(true), minutes * 6e4);
+    state2.periodic.unref?.();
+  }
+  requestGitSnapshot("connect");
+}
+
+// src/core/ws-client/transcript.ts
+function toDtoEntry(e) {
+  return {
+    id: e.id,
+    source: e.source,
+    kind: e.kind,
+    text: e.text,
+    level: e.level,
+    resultKind: e.resultKind,
+    // Processing time on a terminal `exit` entry (ADR-0249) — the web renders it inline.
+    ...e.durationMs != null ? { durationMs: e.durationMs } : {},
+    // AI-run metadata on an `aireq` marker — powers the web's clickable CLI name → details modal.
+    ...e.aiMeta ? { aiMeta: e.aiMeta } : {}
+  };
+}
+function envReconnectMaxSec() {
+  const raw = Number(process.env.FOURPM_RECONNECT_MAX_BACKOFF_SEC);
+  if (!Number.isFinite(raw)) return null;
+  const { min, max } = CLI_SETTINGS_BOUNDS.reconnectMaxBackoffSec;
+  return Math.min(Math.max(Math.floor(raw), min), max);
+}
+
 // src/core/autonomous-cycle.ts
 import { randomUUID } from "crypto";
-import { appendFile as appendFile2, mkdir as mkdir3, readFile as readFile5, readdir as readdir2, rm as rm2, stat } from "fs/promises";
-import { join as join20 } from "path";
-function buildAutonomousCyclePrompt() {
+import { appendFile as appendFile2, mkdir as mkdir3, readFile as readFile6, readdir as readdir2, rm as rm2, stat as stat2 } from "fs/promises";
+import { join as join21 } from "path";
+function buildAutonomousCyclePrompt(opts = {}) {
+  const capNote = opts.intakeBlocked ? `
+
+**Step 2 is DISABLED this cycle** \u2014 the organization reached its monthly plan limit for new \`AI_TODO\` /
+\`USER_QA\` rows. Do NOT add any row to \`AI_TODO.md\` or \`USER_QA.md\`; skip Step 2 entirely and continue
+with the already-approved work.` : "";
   return `You are running UNATTENDED as the 4PM autonomous cycle (headless, one tick). Do EXACTLY ONE small
 work cycle with the steps below, then STOP. Keep each cycle to ONE small task so you never run out of
 tokens mid-way. If a step fails, append a row to the **Incidents** table of \`AI_DONE.md\` and STOP \u2014
 do not push on. Write all books/docs/code in the language the project's \`CLAUDE.md\` specifies (default
-English).
+English).${capNote}
 
 ## Books & approval (MUST read the approvals file)
 The five "book" files at the project root \u2014 \`USER_TODO.md\`, \`USER_QA.md\`, \`AI_TODO.md\`,
@@ -42459,8 +42945,16 @@ async function runAutonomousCycle(ctx) {
     await log(`[run] cycle (tick ${hist.ticks.count}/${today})`);
     const commandId = randomUUID();
     const override = cfg.model ? { model: cfg.model } : void 0;
+    const usage = await readBookUsage(ctx);
+    const intakeBlocked = ["AI_TODO", "USER_QA"].some((b2) => {
+      const c = usage?.books[b2];
+      return !!c && c.limit !== null && c.used >= c.limit;
+    });
+    if (intakeBlocked) await log("[cap] monthly AI_TODO/USER_QA limit reached \u2014 intake skipped this cycle");
+    const booksBefore = await cappedBookIds(root);
     try {
-      await runAiPrompt(ctx, buildAutonomousCyclePrompt(), commandId, "local", false, void 0, override, false, true);
+      await runAiPrompt(ctx, buildAutonomousCyclePrompt({ intakeBlocked }), commandId, "local", false, void 0, override, false, true);
+      await reportNewBookRows(ctx, root, booksBefore);
       hist = await readHistories(root);
       hist.consecutiveFails = 0;
       await recordRun(root, hist, "success", "cycle complete", today);
@@ -42468,6 +42962,7 @@ async function runAutonomousCycle(ctx) {
       ctx.bus.autonomousDone(true);
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
+      await reportNewBookRows(ctx, root, booksBefore);
       hist = await readHistories(root);
       hist.consecutiveFails += 1;
       await recordRun(root, hist, "failure", msg, today);
@@ -42484,13 +42979,32 @@ async function runAutonomousCycle(ctx) {
     running.delete(root);
   }
 }
+async function readBookUsage(ctx) {
+  try {
+    return await ctx.request(WsChannels.AUTONOMOUS_BOOK_USAGE, {});
+  } catch {
+    return null;
+  }
+}
+async function reportNewBookRows(ctx, root, before) {
+  try {
+    const after = await cappedBookIds(root);
+    const added = {};
+    for (const book of Object.keys(after)) {
+      const n = [...after[book]].filter((id) => !before[book].has(id)).length;
+      if (n > 0) added[book] = n;
+    }
+    if (Object.keys(added).length > 0) await ctx.request(WsChannels.AUTONOMOUS_BOOK_USAGE, { added });
+  } catch {
+  }
+}
 async function dayLog(root, line) {
   try {
-    const dir2 = join20(root, ".claude", "logs");
+    const dir2 = join21(root, ".claude", "logs");
     await mkdir3(dir2, { recursive: true });
     const day = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
     const ts2 = (/* @__PURE__ */ new Date()).toISOString().slice(0, 19).replace("T", " ");
-    await appendFile2(join20(dir2, `autonomous-tick-${day}.log`), `${ts2} ${line}
+    await appendFile2(join21(dir2, `autonomous-tick-${day}.log`), `${ts2} ${line}
 `, "utf8");
   } catch {
   }
@@ -42498,12 +43012,12 @@ async function dayLog(root, line) {
 async function pruneLogs(root, retentionDays) {
   if (!(retentionDays > 0)) return;
   try {
-    const dir2 = join20(root, ".claude", "logs");
+    const dir2 = join21(root, ".claude", "logs");
     const cutoff = Date.now() - retentionDays * 864e5;
     for (const f2 of await readdir2(dir2)) {
       if (!/^autonomous-tick-.*\.log$/.test(f2)) continue;
-      const st2 = await stat(join20(dir2, f2)).catch(() => null);
-      if (st2 && st2.mtimeMs < cutoff) await rm2(join20(dir2, f2), { force: true }).catch(() => void 0);
+      const st2 = await stat2(join21(dir2, f2)).catch(() => null);
+      if (st2 && st2.mtimeMs < cutoff) await rm2(join21(dir2, f2), { force: true }).catch(() => void 0);
     }
   } catch {
   }
@@ -42515,15 +43029,15 @@ async function recordRun(root, hist, status, note, today) {
 }
 async function readJsonObject(path) {
   try {
-    return JSON.parse(await readFile5(path, "utf8"));
+    return JSON.parse(await readFile6(path, "utf8"));
   } catch {
     return {};
   }
 }
 async function hasWork(root) {
-  const approvals = await readJsonObject(join20(root, ".claude/.autonomous.approvals.json"));
+  const approvals = await readJsonObject(join21(root, ".claude/.autonomous.approvals.json"));
   const approved = Object.entries(approvals).filter(([, v2]) => v2 && typeof v2 === "object" && v2.approved === true).map(([k2]) => k2);
-  const read = (f2) => readFile5(join20(root, f2), "utf8").catch(() => "");
+  const read = (f2) => readFile6(join21(root, f2), "utf8").catch(() => "");
   const [userTodo, userQa, aiTodo, aiProgress] = await Promise.all([
     read("USER_TODO.md"),
     read("USER_QA.md"),
@@ -42561,12 +43075,12 @@ async function allAiProfilesExhausted(ctx, cfg) {
 
 // src/core/fs-browse.ts
 import { readdir as readdir3 } from "fs/promises";
-import { resolve as resolve4, sep as sep2 } from "path";
+import { resolve as resolve6, sep as sep3 } from "path";
 async function listDir(path, root) {
   if (!root) return { path: "", entries: [] };
-  const base = resolve4(root);
-  const requested = resolve4(base, path && path.trim() ? path : ".");
-  const target = requested === base || requested.startsWith(base + sep2) ? requested : base;
+  const base = resolve6(root);
+  const requested = resolve6(base, path && path.trim() ? path : ".");
+  const target = requested === base || requested.startsWith(base + sep3) ? requested : base;
   try {
     const dirents = await readdir3(target, { withFileTypes: true });
     const entries2 = dirents.map((d) => ({
@@ -42583,14 +43097,14 @@ async function listDir(path, root) {
 }
 
 // src/core/fs-read.ts
-import { readFile as readFile6 } from "fs/promises";
-import { resolve as resolve5, sep as sep3 } from "path";
+import { readFile as readFile7 } from "fs/promises";
+import { resolve as resolve7, sep as sep4 } from "path";
 var MAX_BYTES = 256 * 1024;
 function resolveInRoot(root, relPath) {
   if (!root) return null;
-  const base = resolve5(root);
-  const target = resolve5(base, relPath || ".");
-  return target === base || target.startsWith(base + sep3) ? target : null;
+  const base = resolve7(root);
+  const target = resolve7(base, relPath || ".");
+  return target === base || target.startsWith(base + sep4) ? target : null;
 }
 async function readWorkerFile(root, path) {
   const target = resolveInRoot(root, path);
@@ -42598,7 +43112,7 @@ async function readWorkerFile(root, path) {
     return { path, content: "", truncated: false };
   }
   try {
-    const buf = await readFile6(target);
+    const buf = await readFile7(target);
     const truncated = buf.byteLength > MAX_BYTES;
     const content = buf.subarray(0, MAX_BYTES).toString("utf8");
     return { path: target, content, truncated };
@@ -42609,13 +43123,13 @@ async function readWorkerFile(root, path) {
 
 // src/core/fs-write.ts
 import { mkdir as mkdir4, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname5, resolve as resolve6, sep as sep4 } from "path";
+import { dirname as dirname5, resolve as resolve8, sep as sep5 } from "path";
 var MAX_BYTES2 = 2 * 1024 * 1024;
 function resolveInRoot2(root, relPath) {
   if (!root) return null;
-  const base = resolve6(root);
-  const target = resolve6(base, relPath || ".");
-  return target === base || target.startsWith(base + sep4) ? target : null;
+  const base = resolve8(root);
+  const target = resolve8(base, relPath || ".");
+  return target === base || target.startsWith(base + sep5) ? target : null;
 }
 async function writeWorkerFile(root, relPath, content) {
   const target = resolveInRoot2(root, relPath);
@@ -42636,24 +43150,24 @@ async function writeWorkerFile(root, relPath, content) {
 }
 
 // src/core/fs-mutate.ts
-import { mkdir as mkdir5, writeFile as writeFile6, rename, rm as rm3, stat as stat2 } from "fs/promises";
-import { basename as basename3, dirname as dirname6, resolve as resolve7, sep as sep5 } from "path";
+import { mkdir as mkdir5, writeFile as writeFile6, rename, rm as rm3, stat as stat3 } from "fs/promises";
+import { basename as basename3, dirname as dirname6, resolve as resolve9, sep as sep6 } from "path";
 var MAX_BYTES3 = 2 * 1024 * 1024;
 function resolveInRoot3(root, rel) {
-  const base = resolve7(root);
-  const target = resolve7(base, rel || ".");
-  return target === base || target.startsWith(base + sep5) ? target : null;
+  const base = resolve9(root);
+  const target = resolve9(base, rel || ".");
+  return target === base || target.startsWith(base + sep6) ? target : null;
 }
 async function isDir(p2) {
   try {
-    return (await stat2(p2)).isDirectory();
+    return (await stat3(p2)).isDirectory();
   } catch {
     return false;
   }
 }
 async function exists(p2) {
   try {
-    await stat2(p2);
+    await stat3(p2);
     return true;
   } catch {
     return false;
@@ -42666,13 +43180,13 @@ async function mutateFs(root, req) {
     switch (req.op) {
       case "mkdir": {
         const target = resolveInRoot3(root, req.path ?? "");
-        if (!target || target === resolve7(root)) return escaped(req.path ?? "");
+        if (!target || target === resolve9(root)) return escaped(req.path ?? "");
         await mkdir5(target, { recursive: true });
         return { ok: true, path: target };
       }
       case "create": {
         const target = resolveInRoot3(root, req.path ?? "");
-        if (!target || target === resolve7(root)) return escaped(req.path ?? "");
+        if (!target || target === resolve9(root)) return escaped(req.path ?? "");
         if (await exists(target)) return { ok: false, path: target, error: "already exists" };
         const content = req.content ?? "";
         if (Buffer.byteLength(content, "utf8") > MAX_BYTES3) {
@@ -42686,9 +43200,9 @@ async function mutateFs(root, req) {
         const from = resolveInRoot3(root, req.from ?? "");
         let to2 = resolveInRoot3(root, req.to ?? "");
         if (!from || !to2) return escaped(req.from ?? req.to ?? "");
-        if (from === resolve7(root)) return { ok: false, path: from, error: "cannot move the project root" };
-        if (await isDir(to2)) to2 = resolve7(to2, basename3(from));
-        if (to2 !== resolve7(root) && !to2.startsWith(resolve7(root) + sep5)) return escaped(req.to ?? "");
+        if (from === resolve9(root)) return { ok: false, path: from, error: "cannot move the project root" };
+        if (await isDir(to2)) to2 = resolve9(to2, basename3(from));
+        if (to2 !== resolve9(root) && !to2.startsWith(resolve9(root) + sep6)) return escaped(req.to ?? "");
         if (await exists(to2)) return { ok: false, path: to2, error: "destination already exists" };
         await mkdir5(dirname6(to2), { recursive: true });
         await rename(from, to2);
@@ -42697,7 +43211,7 @@ async function mutateFs(root, req) {
       case "delete": {
         const target = resolveInRoot3(root, req.path ?? "");
         if (!target) return escaped(req.path ?? "");
-        if (target === resolve7(root)) return { ok: false, path: target, error: "cannot delete the project root" };
+        if (target === resolve9(root)) return { ok: false, path: target, error: "cannot delete the project root" };
         await rm3(target, { recursive: true, force: true });
         return { ok: true, path: target };
       }
@@ -42710,13 +43224,13 @@ async function mutateFs(root, req) {
 }
 
 // src/core/fs-transfer.ts
-import { mkdir as mkdir6, readFile as readFile7, stat as stat3, writeFile as writeFile7 } from "fs/promises";
-import { basename as basename4, dirname as dirname7, extname, resolve as resolve8, sep as sep6 } from "path";
+import { mkdir as mkdir6, readFile as readFile8, stat as stat4, writeFile as writeFile7 } from "fs/promises";
+import { basename as basename4, dirname as dirname7, extname, resolve as resolve10, sep as sep7 } from "path";
 function resolveInRoot4(root, relPath) {
   if (!root) return null;
-  const base = resolve8(root);
-  const target = resolve8(base, relPath || ".");
-  return target === base || target.startsWith(base + sep6) ? target : null;
+  const base = resolve10(root);
+  const target = resolve10(base, relPath || ".");
+  return target === base || target.startsWith(base + sep7) ? target : null;
 }
 var MIME_BY_EXT = {
   ".png": "image/png",
@@ -42765,12 +43279,12 @@ async function downloadBinaryFile(root, relPath) {
   const target = resolveInRoot4(root, relPath);
   if (!target) return { error: "path escapes the project root" };
   try {
-    const info = await stat3(target);
+    const info = await stat4(target);
     if (!info.isFile()) return { error: "not a file" };
     if (info.size > FS_TRANSFER_MAX_BYTES) {
       return { error: `file too large (max ${FS_TRANSFER_MAX_BYTES} bytes)` };
     }
-    const buf = await readFile7(target);
+    const buf = await readFile8(target);
     return {
       contentBase64: buf.toString("base64"),
       contentType: guessMime(target),
@@ -42829,16 +43343,16 @@ function handleFsChannels(ctx, message, payload) {
 }
 
 // src/core/git-diff.ts
-import { readFile as readFile8 } from "fs/promises";
-import { execFile as execFile5 } from "child_process";
-import { basename as basename5, dirname as dirname8, resolve as resolve9, sep as sep7 } from "path";
-import { promisify as promisify5 } from "util";
-var run5 = promisify5(execFile5);
+import { readFile as readFile9 } from "fs/promises";
+import { execFile as execFile7 } from "child_process";
+import { basename as basename5, dirname as dirname8, resolve as resolve11, sep as sep8 } from "path";
+import { promisify as promisify7 } from "util";
+var run7 = promisify7(execFile7);
 function resolveInRoot5(root, relPath) {
   if (!root) return null;
-  const base = resolve9(root);
-  const target = resolve9(base, relPath || ".");
-  return target === base || target.startsWith(base + sep7) ? target : null;
+  const base = resolve11(root);
+  const target = resolve11(base, relPath || ".");
+  return target === base || target.startsWith(base + sep8) ? target : null;
 }
 function looksBinary(buf) {
   return buf.subarray(0, 8e3).includes(0);
@@ -42856,12 +43370,12 @@ async function gitDiff(root, path) {
   const base = basename5(target);
   let newBuf = null;
   try {
-    newBuf = await readFile8(target);
+    newBuf = await readFile9(target);
   } catch {
   }
   let oldBuf = null;
   try {
-    const { stdout } = await run5("git", ["show", `HEAD:./${base}`], {
+    const { stdout } = await run7("git", ["show", `HEAD:./${base}`], {
       cwd: dir2,
       timeout: 15e3,
       maxBuffer: FS_TRANSFER_MAX_BYTES + 1024,
@@ -42891,12 +43405,12 @@ async function gitDiff(root, path) {
 }
 
 // src/core/git-env.ts
-import { execFile as execFile6 } from "child_process";
-import { promisify as promisify6 } from "util";
-var run6 = promisify6(execFile6);
+import { execFile as execFile8 } from "child_process";
+import { promisify as promisify8 } from "util";
+var run8 = promisify8(execFile8);
 async function hasBinary(bin, args = ["--version"]) {
   try {
-    await run6(bin, args, { timeout: 5e3 });
+    await run8(bin, args, { timeout: 5e3 });
     return true;
   } catch {
     return false;
@@ -42909,7 +43423,7 @@ async function checkGitEnv(provider) {
   let account = null;
   if (installed) {
     try {
-      const { stdout, stderr } = await run6(bin, ["auth", "status"], { timeout: 8e3 });
+      const { stdout, stderr } = await run8(bin, ["auth", "status"], { timeout: 8e3 });
       const out = `${stdout}
 ${stderr}`;
       authenticated = /logged in|logged into|✓/i.test(out);
@@ -42922,33 +43436,33 @@ ${stderr}`;
 }
 
 // src/core/git-ssh-key.ts
-import { execFile as execFile7 } from "child_process";
-import { readFile as readFile9, rm as rm4, mkdir as mkdir7 } from "fs/promises";
-import { join as join21 } from "path";
-import { promisify as promisify7 } from "util";
-var run7 = promisify7(execFile7);
+import { execFile as execFile9 } from "child_process";
+import { readFile as readFile10, rm as rm4, mkdir as mkdir7 } from "fs/promises";
+import { join as join22 } from "path";
+import { promisify as promisify9 } from "util";
+var run9 = promisify9(execFile9);
 function keyPaths(profileDir2) {
-  const dir2 = join21(profileDir2, ".ssh");
-  const key = join21(dir2, "id_4pm");
+  const dir2 = join22(profileDir2, ".ssh");
+  const key = join22(dir2, "id_4pm");
   return { dir: dir2, key, pub: `${key}.pub` };
 }
 async function readPublicKey(pub) {
   try {
-    return (await readFile9(pub, "utf8")).trim();
+    return (await readFile10(pub, "utf8")).trim();
   } catch {
     return null;
   }
 }
 async function fingerprintOf(pub) {
   try {
-    const { stdout } = await run7("ssh-keygen", ["-lf", pub], { timeout: 5e3 });
+    const { stdout } = await run9("ssh-keygen", ["-lf", pub], { timeout: 5e3 });
     return stdout.match(/SHA256:[A-Za-z0-9+/=]+/)?.[0] ?? null;
   } catch {
     return null;
   }
 }
 async function configureGit(key) {
-  await run7(
+  await run9(
     "git",
     ["config", "--global", "core.sshCommand", `ssh -i ${key} -o IdentitiesOnly=yes`],
     { timeout: 5e3 }
@@ -42959,7 +43473,7 @@ async function generate(profileDir2) {
   await mkdir7(dir2, { recursive: true });
   await rm4(key, { force: true });
   await rm4(pub, { force: true });
-  await run7("ssh-keygen", ["-t", "ed25519", "-f", key, "-N", "", "-C", "4pm-deploy-key"], {
+  await run9("ssh-keygen", ["-t", "ed25519", "-f", key, "-N", "", "-C", "4pm-deploy-key"], {
     timeout: 15e3
   });
   await configureGit(key);
@@ -42969,7 +43483,7 @@ async function remove(profileDir2) {
   const { key, pub } = keyPaths(profileDir2);
   await rm4(key, { force: true });
   await rm4(pub, { force: true });
-  await run7("git", ["config", "--global", "--unset", "core.sshCommand"], { timeout: 5e3 }).catch(
+  await run9("git", ["config", "--global", "--unset", "core.sshCommand"], { timeout: 5e3 }).catch(
     () => void 0
   );
   return { publicKey: null, fingerprint: null };
@@ -42989,109 +43503,6 @@ async function manageSshKey(op, profileDir2) {
   }
 }
 
-// src/core/git-history.ts
-import { execFile as execFile8 } from "child_process";
-import { resolve as resolve10, sep as sep8 } from "path";
-import { promisify as promisify8 } from "util";
-var run8 = promisify8(execFile8);
-var FS = "";
-var RS = "";
-function resolveRepo(root, repo) {
-  if (!root) return null;
-  const base = resolve10(root);
-  const requested = resolve10(base, repo && repo.trim() ? repo : ".");
-  return requested === base || requested.startsWith(base + sep8) ? requested : base;
-}
-async function git(cwd2, args) {
-  try {
-    const { stdout } = await run8("git", args, {
-      cwd: cwd2,
-      timeout: 15e3,
-      maxBuffer: 8 * 1024 * 1024
-    });
-    return stdout;
-  } catch {
-    return "";
-  }
-}
-async function gitRepos(root) {
-  if (!root) return { repos: [] };
-  const base = resolve10(root);
-  const top = (await git(base, ["rev-parse", "--show-toplevel"])).trim();
-  if (!top || !(top === base || top.startsWith(base + sep8))) return { repos: [] };
-  const repos = [];
-  const rootRemote = (await git(base, ["remote", "get-url", "origin"])).trim();
-  const rootBranch = (await git(base, ["rev-parse", "--abbrev-ref", "HEAD"])).trim();
-  repos.push({ subdir: "", name: "", remote: rootRemote || null, branch: rootBranch || null });
-  const subOut = await git(base, ["submodule", "status"]);
-  for (const line of subOut.split("\n")) {
-    const m2 = line.trim().match(/^[-+U ]?[0-9a-f]{7,40}\s+(\S+)/);
-    const subPath = m2?.[1];
-    if (!subPath) continue;
-    const abs = resolve10(base, subPath);
-    if (!(abs === base || abs.startsWith(base + sep8))) continue;
-    const remote = (await git(abs, ["remote", "get-url", "origin"])).trim();
-    const branch = (await git(abs, ["rev-parse", "--abbrev-ref", "HEAD"])).trim();
-    repos.push({ subdir: subPath, name: subPath, remote: remote || null, branch: branch || null });
-  }
-  return { repos };
-}
-async function gitLog(root, repo, skip, limit) {
-  const cwd2 = resolveRepo(root, repo);
-  if (!cwd2) return { entries: [], hasMore: false };
-  const capped = Math.min(Math.max(limit, 1), 200);
-  const format = ["%H", "%h", "%an", "%aI", "%s"].join(FS) + RS;
-  const stdout = await git(cwd2, [
-    "log",
-    `--skip=${Math.max(skip, 0)}`,
-    `-n`,
-    String(capped + 1),
-    `--pretty=format:${format}`
-  ]);
-  const rows = stdout.split(RS).map((r) => r.replace(/^\n/, "")).filter((r) => r.length > 0);
-  const entries2 = rows.slice(0, capped).map((row) => {
-    const [hash = "", shortHash = "", author = "", date = "", subject = ""] = row.split(FS);
-    return { hash, shortHash, author, date, subject };
-  });
-  return { entries: entries2, hasMore: rows.length > capped };
-}
-async function gitCommit(root, repo, hash) {
-  const cwd2 = resolveRepo(root, repo);
-  const empty = { hash, author: "", date: "", subject: "", files: [] };
-  if (!cwd2 || !hash) return empty;
-  const format = ["%H", "%an", "%aI", "%s"].join(FS);
-  const stdout = await git(cwd2, [
-    "show",
-    "--name-status",
-    "-M",
-    `--pretty=format:${format}`,
-    hash
-  ]);
-  if (!stdout) return empty;
-  const lines = stdout.split("\n");
-  const [full = hash, author = "", date = "", subject = ""] = (lines[0] ?? "").split(FS);
-  const files = [];
-  for (const line of lines.slice(1)) {
-    if (!line.trim()) continue;
-    const parts = line.split("	");
-    const status = (parts[0] ?? "").charAt(0);
-    if (!status) continue;
-    if (status === "R" || status === "C") {
-      files.push({ path: parts[2] ?? "", status, oldPath: parts[1] ?? void 0 });
-    } else {
-      files.push({ path: parts[1] ?? "", status });
-    }
-  }
-  return { hash: full, author, date, subject, files };
-}
-async function gitCommitDiff(root, repo, hash, path) {
-  const cwd2 = resolveRepo(root, repo);
-  if (!cwd2 || !hash || !path) return { path, oldContent: "", newContent: "" };
-  const oldContent = await git(cwd2, ["show", `${hash}^:${path}`]);
-  const newContent = await git(cwd2, ["show", `${hash}:${path}`]);
-  return { path, oldContent, newContent };
-}
-
 // src/core/ws-client/handlers/git.ts
 function handleGitChannels(ctx, message, payload) {
   switch (message.channel) {
@@ -43144,12 +43555,12 @@ function handleGitChannels(ctx, message, payload) {
 }
 
 // src/core/ws-client/handlers/misc.ts
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 
 // src/core/ai-assist.ts
-import { execFile as execFile9 } from "child_process";
-import { promisify as promisify9 } from "util";
-var run9 = promisify9(execFile9);
+import { execFile as execFile10 } from "child_process";
+import { promisify as promisify10 } from "util";
+var run10 = promisify10(execFile10);
 function aiCli() {
   return process.env.AI_CLI || "claude";
 }
@@ -43192,7 +43603,7 @@ function parseAi(cli, stdout, prompt) {
 }
 async function runAi(prompt) {
   const cli = aiCli();
-  const { stdout } = await run9(cli, aiArgs(cli, prompt), {
+  const { stdout } = await run10(cli, aiArgs(cli, prompt), {
     timeout: 12e4,
     maxBuffer: 8 * 1024 * 1024
   });
@@ -43294,7 +43705,7 @@ function handleMiscChannels(ctx, message, payload) {
     }
     case WsChannels.LOG_READ: {
       const limit = Math.min(Math.max(payload.limit ?? 200, 1), 2e3);
-      const lines = readRecentLogLines(join22(ctx.profileDir, "logs"), limit);
+      const lines = readRecentLogLines(join23(ctx.profileDir, "logs"), limit);
       ctx.send(WsChannels.LOG_READ, { lines }, message.id);
       return true;
     }
@@ -43326,7 +43737,7 @@ function handleMiscChannels(ctx, message, payload) {
 
 // src/core/ws-client/handlers/project.ts
 import { existsSync as existsSync14, mkdirSync as mkdirSync7, renameSync, rmSync as rmSync7 } from "fs";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 
 // src/core/ai-task.ts
 import { randomUUID as randomUUID2 } from "crypto";
@@ -43398,8 +43809,8 @@ function handleProjectChannels(ctx, message, payload) {
     case WsChannels.PHYSIC_SYNC: {
       const sync = payload;
       const oldName = sync.oldName;
-      const oldPath = oldName ? join23(ctx.profileDir, oldName) : null;
-      const newPath = join23(ctx.profileDir, sync.newName);
+      const oldPath = oldName ? join24(ctx.profileDir, oldName) : null;
+      const newPath = join24(ctx.profileDir, sync.newName);
       if (oldName) {
         const oldRoot = ctx.physicFolderPath(oldName);
         if (oldRoot) void uninstallCron(oldRoot).catch(() => void 0);
@@ -43411,6 +43822,7 @@ function handleProjectChannels(ctx, message, payload) {
         mkdirSync7(newPath, { recursive: true });
       }
       ctx.physicRoot = ctx.physicFolderPath(sync.newName);
+      requestGitSnapshot("physic-sync");
       ctx.bus.setProject(sync.newName);
       ctx.bus.log(t("project.folderSynced", { name: sync.newName }));
       void ctx.cloneServingRepos().catch(() => void 0);
@@ -43421,7 +43833,7 @@ function handleProjectChannels(ctx, message, payload) {
       if (del.name) {
         const delRoot = ctx.physicFolderPath(del.name);
         if (delRoot) void uninstallCron(delRoot).catch(() => void 0);
-        rmSync7(join23(ctx.profileDir, del.name), { recursive: true, force: true });
+        rmSync7(join24(ctx.profileDir, del.name), { recursive: true, force: true });
         ctx.bus.log(t("project.folderDeleted", { name: del.name }));
       }
       void manageSshKey("delete", ctx.profileDir).catch(() => void 0);
@@ -43440,6 +43852,7 @@ function handleProjectChannels(ctx, message, payload) {
         projectAiMemoryBudgetChars: tokens.memory?.budgetChars ?? 0
       });
       ctx.setRestrictToFolder(tokens.restrictToFolder === true);
+      if (tokens.gitAuth !== void 0) applyGitAuth(ctx, tokens.gitAuth, tokens.gitAuthHost ?? null);
       logger.info("project.tokens.applied", {
         aiRunTimeoutSec: tokens.aiRunTimeoutSec ?? 0,
         autoClearIdleMinutes: tokens.autoClearIdleMinutes ?? 0
@@ -43452,9 +43865,28 @@ function handleProjectChannels(ctx, message, payload) {
         ctx.profileDir,
         (p2) => ctx.send(WsChannels.PROJECT_PROGRESS, p2),
         // AI init on the standard AI path + one org run slot (ADR-0362).
-        createAiTaskRunner(ctx)
-      ).then((reply) => ctx.send(WsChannels.PROJECT_CREATE, reply, message.id));
+        createAiTaskRunner(ctx),
+        (method, host) => applyGitAuth(ctx, method, host)
+      ).then((reply) => {
+        ctx.send(WsChannels.PROJECT_CREATE, reply, message.id);
+        requestGitSnapshot("scaffold");
+      });
       return true;
+    case WsChannels.PROJECT_PUBLISH: {
+      const root = ctx.physicRoot;
+      if (!root) {
+        ctx.send(WsChannels.PROJECT_PUBLISH, { publish: null, error: "This worker has no project folder." }, message.id);
+        return true;
+      }
+      const projectId = payload.projectId;
+      void publishScaffold(root, (step, msg) => ctx.send(WsChannels.PROJECT_PROGRESS, { projectId, step, message: msg })).then((publish) => {
+        ctx.send(WsChannels.PROJECT_PUBLISH, { publish }, message.id);
+        requestGitSnapshot("publish");
+      }).catch(
+        (err) => ctx.send(WsChannels.PROJECT_PUBLISH, { publish: null, error: String(err) }, message.id)
+      );
+      return true;
+    }
     case WsChannels.PROJECT_ADD:
       void addProject(
         payload,
@@ -43462,12 +43894,23 @@ function handleProjectChannels(ctx, message, payload) {
         (p2) => ctx.send(WsChannels.PROJECT_PROGRESS, p2),
         // An add-with-scaffold runs AI init too (ADR-0362).
         createAiTaskRunner(ctx)
-      ).then((reply) => ctx.send(WsChannels.PROJECT_ADD, reply, message.id));
+      ).then((reply) => {
+        ctx.send(WsChannels.PROJECT_ADD, reply, message.id);
+        requestGitSnapshot("provision");
+      });
       return true;
     default:
       return false;
   }
 }
+function applyGitAuth(ctx, method, host) {
+  configureGitAuth(
+    method ?? null,
+    host,
+    ctx.profileDir,
+    (req) => ctx.request(WsChannels.GIT_TOKEN, req)
+  );
+}
 
 // src/core/knowledge-compose.ts
 import { spawn as spawn8 } from "child_process";
@@ -43489,7 +43932,7 @@ Extra focus from the author: ${req.prompt}` : "";
   ].join("\n");
 }
 function runOnce2(cmd, profile, prompt, cwd2, extraEnv, denyDirs = []) {
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     const args = ["-p", ...profile?.model ? ["--model", profile.model] : [], ...denySettingsArgs(cmd, [...denyDirs, profile?.dir])];
     const env3 = {
       ...process.env,
@@ -43512,7 +43955,7 @@ function runOnce2(cmd, profile, prompt, cwd2, extraEnv, denyDirs = []) {
     });
     child.on("close", (code) => {
       clearTimeout(timer);
-      resolve12({ code: code ?? -1, out, err });
+      resolve13({ code: code ?? -1, out, err });
     });
     child.stdin.write(prompt);
     child.stdin.end();
@@ -43542,13 +43985,13 @@ async function runKnowledgeCompose(req, ai2, physicRoot) {
 }
 
 // src/core/faq-compose.ts
-import { spawn as spawn9, execFile as execFile10 } from "child_process";
+import { spawn as spawn9, execFile as execFile11 } from "child_process";
 import { existsSync as existsSync15, mkdirSync as mkdirSync8, rmSync as rmSync8 } from "fs";
 import { randomUUID as randomUUID3 } from "crypto";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 import { tmpdir as tmpdir4 } from "os";
-import { promisify as promisify10 } from "util";
-var execFileAsync2 = promisify10(execFile10);
+import { promisify as promisify11 } from "util";
+var execFileAsync2 = promisify11(execFile11);
 var NO_USAGE2 = { tokens: 0, input: 0, output: 0, cacheRead: 0, cacheCreation: 0 };
 var COMPOSE_TIMEOUT_MS2 = 10 * 60 * 1e3;
 var AGENT_DENIED_TOOLS = ["Bash", "WebFetch", "WebSearch", "NotebookEdit", "Task"];
@@ -43613,7 +44056,7 @@ function parsePerTicket(text) {
   return [];
 }
 function runClaudeOnce2(cmd, profile, prompt, cwd2, extraEnv, denyDirs = []) {
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     const isClaude = cmd.includes("claude");
     const args = [
       "-p",
@@ -43646,7 +44089,7 @@ function runClaudeOnce2(cmd, profile, prompt, cwd2, extraEnv, denyDirs = []) {
     child.on("close", (code) => {
       clearTimeout(timer);
       out += parser.flush();
-      resolve12({ code: code ?? -1, out, err, usage: parser.usage() });
+      resolve13({ code: code ?? -1, out, err, usage: parser.usage() });
     });
     child.stdin.write(prompt);
     child.stdin.end();
@@ -43666,7 +44109,7 @@ async function runClaudeWithFailover2(prompt, cwd2, ai2) {
 var MAX_OUTPUT_CHARS = 8e3;
 async function runFaqCompose(req, ai2) {
   if (!req.repo.token) return { prUrl: "", error: "no write token" };
-  const workDir = join24(tmpdir4(), "4pm-faq-sync", randomUUID3());
+  const workDir = join25(tmpdir4(), "4pm-faq-sync", randomUUID3());
   const gitEnv = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
   const auth = gitAuthArgs("x-access-token", req.repo.token);
   try {
@@ -43894,8 +44337,8 @@ function handleToolsChannels(ctx, message, payload) {
 }
 
 // src/core/agents.ts
-import { readFile as readFile10, writeFile as writeFile8, mkdir as mkdir8, readdir as readdir4, rm as rm5 } from "fs/promises";
-import { join as join25 } from "path";
+import { readFile as readFile11, writeFile as writeFile8, mkdir as mkdir8, readdir as readdir4, rm as rm5 } from "fs/promises";
+import { join as join26 } from "path";
 var AGENTS_REL = ".claude/agents";
 var SKILLS_REL = ".claude/skills";
 var MEMORY_DIRS = /* @__PURE__ */ new Set(["short-memory", "long-memory"]);
@@ -43904,7 +44347,7 @@ function safeName(name) {
 }
 async function readText2(path, fallback = "") {
   try {
-    return await readFile10(path, "utf8");
+    return await readFile11(path, "utf8");
   } catch {
     return fallback;
   }
@@ -43919,17 +44362,17 @@ async function listAgents(root) {
   const subagents = [];
   const skills = [];
   try {
-    for (const e of await readdir4(join25(root, AGENTS_REL), { withFileTypes: true })) {
+    for (const e of await readdir4(join26(root, AGENTS_REL), { withFileTypes: true })) {
       if (!e.isFile() || !e.name.endsWith(".md") || MEMORY_DIRS.has(e.name)) continue;
-      const fm = frontmatter(await readText2(join25(root, AGENTS_REL, e.name)));
+      const fm = frontmatter(await readText2(join26(root, AGENTS_REL, e.name)));
       subagents.push({ name: e.name.replace(/\.md$/, ""), description: fm.description });
     }
   } catch {
   }
   try {
-    for (const e of await readdir4(join25(root, SKILLS_REL), { withFileTypes: true })) {
+    for (const e of await readdir4(join26(root, SKILLS_REL), { withFileTypes: true })) {
       if (!e.isDirectory()) continue;
-      const fm = frontmatter(await readText2(join25(root, SKILLS_REL, e.name, "SKILL.md")));
+      const fm = frontmatter(await readText2(join26(root, SKILLS_REL, e.name, "SKILL.md")));
       skills.push({ name: e.name, description: fm.description });
     }
   } catch {
@@ -43940,15 +44383,15 @@ async function listAgents(root) {
 }
 function itemPath(root, kind, name) {
   const n = safeName(name);
-  return kind === "subagent" ? join25(root, AGENTS_REL, `${n}.md`) : join25(root, SKILLS_REL, n, "SKILL.md");
+  return kind === "subagent" ? join26(root, AGENTS_REL, `${n}.md`) : join26(root, SKILLS_REL, n, "SKILL.md");
 }
 async function readAgent(root, kind, name) {
   const content = await readText2(itemPath(root, kind, name));
   if (kind !== "subagent") return { content };
   const n = safeName(name);
   const [short, long] = await Promise.all([
-    readText2(join25(root, AGENTS_REL, "short-memory", `${n}.md`)),
-    readText2(join25(root, AGENTS_REL, "long-memory", `${n}.md`))
+    readText2(join26(root, AGENTS_REL, "short-memory", `${n}.md`)),
+    readText2(join26(root, AGENTS_REL, "long-memory", `${n}.md`))
   ]);
   return { content, memory: { short, long } };
 }
@@ -43958,12 +44401,12 @@ async function writeAgent(root, req) {
   try {
     if (req.action === "delete") {
       if (req.kind === "subagent") await rm5(itemPath(root, "subagent", n), { force: true });
-      else await rm5(join25(root, SKILLS_REL, n), { recursive: true, force: true });
+      else await rm5(join26(root, SKILLS_REL, n), { recursive: true, force: true });
       return { ok: true };
     }
     if (req.content === void 0) return { ok: false, error: "content is required" };
     const path = itemPath(root, req.kind, n);
-    await mkdir8(join25(path, ".."), { recursive: true });
+    await mkdir8(join26(path, ".."), { recursive: true });
     await writeFile8(path, req.content, "utf8");
     return { ok: true };
   } catch (err) {
@@ -43972,21 +44415,21 @@ async function writeAgent(root, req) {
 }
 
 // src/core/secrets.ts
-import { readFile as readFile11, writeFile as writeFile9 } from "fs/promises";
-import { join as join26 } from "path";
+import { readFile as readFile12, writeFile as writeFile9 } from "fs/promises";
+import { join as join27 } from "path";
 var SECURITY_REL = "AI_SECURITY.md";
 var PLACEHOLDER_REL = "AI_PLACEHOLDER.md";
 var SECRETS_REL = "project.secrets.json";
 async function readText3(path, fallback = "") {
   try {
-    return await readFile11(path, "utf8");
+    return await readFile12(path, "utf8");
   } catch {
     return fallback;
   }
 }
 async function readSecretsObject(root) {
   try {
-    const v2 = JSON.parse(await readFile11(join26(root, SECRETS_REL), "utf8"));
+    const v2 = JSON.parse(await readFile12(join27(root, SECRETS_REL), "utf8"));
     return v2 && typeof v2 === "object" ? v2 : {};
   } catch {
     return {};
@@ -44005,8 +44448,8 @@ function placeholderKeys(text) {
 }
 async function readSecrets(root) {
   const [security, placeholder, secrets] = await Promise.all([
-    readText3(join26(root, SECURITY_REL)),
-    readText3(join26(root, PLACEHOLDER_REL)),
+    readText3(join27(root, SECURITY_REL)),
+    readText3(join27(root, PLACEHOLDER_REL)),
     readSecretsObject(root)
   ]);
   const names = /* @__PURE__ */ new Set([...placeholderKeys(placeholder), ...Object.keys(secrets)]);
@@ -44019,14 +44462,14 @@ async function readSecrets(root) {
 async function writeSecrets(root, req) {
   try {
     if (req.kind === "security") {
-      await writeFile9(join26(root, SECURITY_REL), req.content, "utf8");
+      await writeFile9(join27(root, SECURITY_REL), req.content, "utf8");
     } else if (req.kind === "placeholder") {
-      await writeFile9(join26(root, PLACEHOLDER_REL), req.content, "utf8");
+      await writeFile9(join27(root, PLACEHOLDER_REL), req.content, "utf8");
     } else {
       const secrets = await readSecretsObject(root);
       if (req.kind === "secret") secrets[req.key] = req.value;
       else delete secrets[req.key];
-      await writeFile9(join26(root, SECRETS_REL), JSON.stringify(secrets, null, 2) + "\n", "utf8");
+      await writeFile9(join27(root, SECRETS_REL), JSON.stringify(secrets, null, 2) + "\n", "utf8");
     }
     return { ok: true };
   } catch (err) {
@@ -44035,17 +44478,17 @@ async function writeSecrets(root, req) {
 }
 
 // src/core/agent-tools.ts
-import { readFile as readFile12, writeFile as writeFile10, mkdir as mkdir9 } from "fs/promises";
-import { dirname as dirname9, join as join27 } from "path";
+import { readFile as readFile13, writeFile as writeFile10, mkdir as mkdir9 } from "fs/promises";
+import { dirname as dirname9, join as join28 } from "path";
 var SHARED_REL = ".claude/settings.json";
 var LOCAL_REL = ".claude/settings.local.json";
 var SECRETS_DENY = "Read(./project.secrets.json)";
 function fileFor(root, scope) {
-  return join27(root, scope === "shared" ? SHARED_REL : LOCAL_REL);
+  return join28(root, scope === "shared" ? SHARED_REL : LOCAL_REL);
 }
 async function readSettingsObject(path) {
   try {
-    const v2 = JSON.parse(await readFile12(path, "utf8"));
+    const v2 = JSON.parse(await readFile13(path, "utf8"));
     return v2 && typeof v2 === "object" ? v2 : {};
   } catch {
     return {};
@@ -44077,8 +44520,8 @@ async function writeAgentTools(root, scope, permissions) {
 
 // src/core/packages.ts
 import { createHash as createHash4 } from "crypto";
-import { readFile as readFile13, writeFile as writeFile11, mkdir as mkdir10, readdir as readdir5, rm as rm6, stat as stat4 } from "fs/promises";
-import { dirname as dirname10, join as join28, relative } from "path";
+import { readFile as readFile14, writeFile as writeFile11, mkdir as mkdir10, readdir as readdir5, rm as rm6, stat as stat5 } from "fs/promises";
+import { dirname as dirname10, join as join29, relative } from "path";
 var AGENTS_REL2 = ".claude/agents";
 var SKILLS_REL2 = ".claude/skills";
 var MANIFEST_REL = ".claude/.4pm-packages.json";
@@ -44087,7 +44530,7 @@ function safeName2(name) {
 }
 async function readMaybe(path) {
   try {
-    return await readFile13(path);
+    return await readFile14(path);
   } catch {
     return null;
   }
@@ -44102,7 +44545,7 @@ async function listFilesRel(dir2) {
       return;
     }
     for (const e of entries2) {
-      const full = join28(d, e.name);
+      const full = join29(d, e.name);
       if (e.isDirectory()) await walk2(full);
       else if (e.isFile()) out.push(relative(dir2, full));
     }
@@ -44113,16 +44556,16 @@ async function listFilesRel(dir2) {
 async function readArtifactFiles(root, kind, slug) {
   const files = [];
   if (kind === "subagent") {
-    const agent = await readMaybe(join28(root, AGENTS_REL2, `${slug}.md`));
+    const agent = await readMaybe(join29(root, AGENTS_REL2, `${slug}.md`));
     if (agent) files.push({ path: "agent.md", contentBase64: agent.toString("base64") });
-    const short = await readMaybe(join28(root, AGENTS_REL2, "short-memory", `${slug}.md`));
+    const short = await readMaybe(join29(root, AGENTS_REL2, "short-memory", `${slug}.md`));
     if (short) files.push({ path: "short-memory.md", contentBase64: short.toString("base64") });
-    const long = await readMaybe(join28(root, AGENTS_REL2, "long-memory", `${slug}.md`));
+    const long = await readMaybe(join29(root, AGENTS_REL2, "long-memory", `${slug}.md`));
     if (long) files.push({ path: "long-memory.md", contentBase64: long.toString("base64") });
   } else {
-    const base = join28(root, SKILLS_REL2, slug);
+    const base = join29(root, SKILLS_REL2, slug);
     for (const rel of await listFilesRel(base)) {
-      const buf = await readMaybe(join28(base, rel));
+      const buf = await readMaybe(join29(base, rel));
       if (buf) files.push({ path: rel.split("\\").join("/"), contentBase64: buf.toString("base64") });
     }
   }
@@ -44140,16 +44583,16 @@ async function artifactSha256(root, kind, slug) {
   return h.digest("hex");
 }
 async function artifactExists(root, kind, slug) {
-  const target = kind === "subagent" ? join28(root, AGENTS_REL2, `${slug}.md`) : join28(root, SKILLS_REL2, slug);
+  const target = kind === "subagent" ? join29(root, AGENTS_REL2, `${slug}.md`) : join29(root, SKILLS_REL2, slug);
   try {
-    await stat4(target);
+    await stat5(target);
     return true;
   } catch {
     return false;
   }
 }
 async function readManifest(root) {
-  const buf = await readMaybe(join28(root, MANIFEST_REL));
+  const buf = await readMaybe(join29(root, MANIFEST_REL));
   if (!buf) return {};
   try {
     return JSON.parse(buf.toString("utf8"));
@@ -44158,7 +44601,7 @@ async function readManifest(root) {
   }
 }
 async function writeManifest(root, manifest) {
-  const path = join28(root, MANIFEST_REL);
+  const path = join29(root, MANIFEST_REL);
   await mkdir10(dirname10(path), { recursive: true });
   await writeFile11(path, JSON.stringify(manifest, null, 2), "utf8");
 }
@@ -44167,24 +44610,24 @@ async function writeArtifactFiles(root, kind, slug, files) {
   if (kind === "subagent") {
     const agent = byPath.get("agent.md");
     if (agent) {
-      await mkdir10(join28(root, AGENTS_REL2), { recursive: true });
-      await writeFile11(join28(root, AGENTS_REL2, `${slug}.md`), agent);
+      await mkdir10(join29(root, AGENTS_REL2), { recursive: true });
+      await writeFile11(join29(root, AGENTS_REL2, `${slug}.md`), agent);
     }
     const short = byPath.get("short-memory.md");
     if (short) {
-      await mkdir10(join28(root, AGENTS_REL2, "short-memory"), { recursive: true });
-      await writeFile11(join28(root, AGENTS_REL2, "short-memory", `${slug}.md`), short);
+      await mkdir10(join29(root, AGENTS_REL2, "short-memory"), { recursive: true });
+      await writeFile11(join29(root, AGENTS_REL2, "short-memory", `${slug}.md`), short);
     }
     const long = byPath.get("long-memory.md");
     if (long) {
-      await mkdir10(join28(root, AGENTS_REL2, "long-memory"), { recursive: true });
-      await writeFile11(join28(root, AGENTS_REL2, "long-memory", `${slug}.md`), long);
+      await mkdir10(join29(root, AGENTS_REL2, "long-memory"), { recursive: true });
+      await writeFile11(join29(root, AGENTS_REL2, "long-memory", `${slug}.md`), long);
     }
   } else {
-    const base = join28(root, SKILLS_REL2, slug);
+    const base = join29(root, SKILLS_REL2, slug);
     for (const [rel, buf] of byPath) {
       if (rel.includes("..") || rel.startsWith("/")) continue;
-      const dest = join28(base, rel);
+      const dest = join29(base, rel);
       await mkdir10(dirname10(dest), { recursive: true });
       await writeFile11(dest, buf);
     }
@@ -44250,11 +44693,11 @@ async function removePackage(root, slug) {
     const entry = manifest[n];
     if (!entry) return { ok: false, error: "not installed" };
     if (entry.kind === "subagent") {
-      await rm6(join28(root, AGENTS_REL2, `${n}.md`), { force: true });
-      await rm6(join28(root, AGENTS_REL2, "short-memory", `${n}.md`), { force: true });
-      await rm6(join28(root, AGENTS_REL2, "long-memory", `${n}.md`), { force: true });
+      await rm6(join29(root, AGENTS_REL2, `${n}.md`), { force: true });
+      await rm6(join29(root, AGENTS_REL2, "short-memory", `${n}.md`), { force: true });
+      await rm6(join29(root, AGENTS_REL2, "long-memory", `${n}.md`), { force: true });
     } else {
-      await rm6(join28(root, SKILLS_REL2, n), { recursive: true, force: true });
+      await rm6(join29(root, SKILLS_REL2, n), { recursive: true, force: true });
     }
     delete manifest[n];
     await writeManifest(root, manifest);
@@ -44265,8 +44708,8 @@ async function removePackage(root, slug) {
 }
 
 // src/core/graph.ts
-import { readFile as readFile14, readdir as readdir6 } from "fs/promises";
-import { join as join29, relative as relative2, dirname as dirname11, resolve as resolve11, extname as extname2, basename as basename6 } from "path";
+import { readFile as readFile15, readdir as readdir6 } from "fs/promises";
+import { join as join30, relative as relative2, dirname as dirname11, resolve as resolve12, extname as extname2, basename as basename6 } from "path";
 var MAX_FILES = 2e3;
 var MAX_NODES = 3e3;
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".next", "out", "coverage", ".turbo"]);
@@ -44286,7 +44729,7 @@ async function walk(root, accept) {
       if (e.name.startsWith(".") && e.name !== ".claude") {
         if (e.isDirectory()) continue;
       }
-      const full = join29(dir2, e.name);
+      const full = join30(dir2, e.name);
       if (e.isDirectory()) {
         if (!SKIP_DIRS.has(e.name)) stack.push(full);
       } else if (accept(full)) {
@@ -44314,14 +44757,14 @@ async function buildDocs(root) {
     const rel = relative2(root, f2).split("\\").join("/");
     let text = "";
     try {
-      text = await readFile14(f2, "utf8");
+      text = await readFile15(f2, "utf8");
     } catch {
       continue;
     }
     for (const m2 of text.matchAll(/\[[^\]]*\]\(([^)]+)\)/g)) {
       const href = (m2[1] ?? "").split("#")[0].trim();
       if (!href || !href.endsWith(".md") || href.startsWith("http")) continue;
-      const target = relative2(root, resolve11(dirname11(f2), href)).split("\\").join("/");
+      const target = relative2(root, resolve12(dirname11(f2), href)).split("\\").join("/");
       if (ids.has(target) && target !== rel) {
         const key = `${rel}->${target}`;
         if (!seen.has(key)) {
@@ -44353,7 +44796,7 @@ async function buildCode(root) {
     const rel = relative2(root, f2).split("\\").join("/");
     let text = "";
     try {
-      text = await readFile14(f2, "utf8");
+      text = await readFile15(f2, "utf8");
     } catch {
       continue;
     }
@@ -44405,17 +44848,17 @@ async function buildGraph(root, mode) {
 }
 
 // src/core/rag.ts
-import { readFile as readFile15, writeFile as writeFile12, statfs as statfs2, mkdir as mkdir11 } from "fs/promises";
+import { readFile as readFile16, writeFile as writeFile12, statfs as statfs2, mkdir as mkdir11 } from "fs/promises";
 import { existsSync as existsSync16 } from "fs";
-import { execFile as execFile11, spawn as spawn10 } from "child_process";
+import { execFile as execFile12, spawn as spawn10 } from "child_process";
 import { totalmem as totalmem2, cpus as cpus2 } from "os";
-import { join as join30 } from "path";
-import { promisify as promisify11 } from "util";
-var run10 = promisify11(execFile11);
+import { join as join31 } from "path";
+import { promisify as promisify12 } from "util";
+var run11 = promisify12(execFile12);
 var RAG_REL = ".claude/rag";
 async function tryRun(cmd, args) {
   try {
-    const { stdout } = await run10(cmd, args, { timeout: 8e3 });
+    const { stdout } = await run11(cmd, args, { timeout: 8e3 });
     return { ok: true, out: stdout.trim() };
   } catch {
     return { ok: false, out: "" };
@@ -44430,7 +44873,7 @@ async function detectPython() {
 }
 async function installLog(root) {
   try {
-    const text = await readFile15(join30(root, RAG_REL, "install.log"), "utf8");
+    const text = await readFile16(join31(root, RAG_REL, "install.log"), "utf8");
     return text.split("\n").filter((l) => l.length > 0).slice(-200);
   } catch {
     return [];
@@ -44492,14 +44935,14 @@ async function ragStatus(root) {
   };
   let modelName = "";
   try {
-    modelName = (await readFile15(join30(root, RAG_REL, ".installed"), "utf8")).trim();
+    modelName = (await readFile16(join31(root, RAG_REL, ".installed"), "utf8")).trim();
   } catch {
     modelName = "";
   }
   const modelPresent = modelName.length > 0;
   return {
     installed: fastembed && sqliteVec && modelPresent,
-    installing: existsSync16(join30(root, RAG_REL, ".installing")),
+    installing: existsSync16(join31(root, RAG_REL, ".installing")),
     python: { found: py.found, version: py.version },
     deps: { pip, fastembed, sqliteVec },
     model: { present: modelPresent, name: modelName },
@@ -44510,9 +44953,9 @@ async function ragStatus(root) {
   };
 }
 async function readIndexMeta(root) {
-  const indexing = existsSync16(join30(root, RAG_REL, ".indexing"));
+  const indexing = existsSync16(join31(root, RAG_REL, ".indexing"));
   try {
-    const m2 = JSON.parse(await readFile15(join30(root, RAG_REL, ".index.json"), "utf8"));
+    const m2 = JSON.parse(await readFile16(join31(root, RAG_REL, ".index.json"), "utf8"));
     return {
       present: true,
       indexing,
@@ -44579,14 +45022,14 @@ if __name__ == "__main__":
     elif cmd == "query": query(sys.argv[2], int(sys.argv[3]) if len(sys.argv) > 3 else 8)
 `;
 async function ensureEngine(root) {
-  await mkdir11(join30(root, RAG_REL), { recursive: true }).catch(() => void 0);
-  await writeFile12(join30(root, RAG_REL, "rag_engine.py"), RAG_ENGINE_PY, "utf8");
+  await mkdir11(join31(root, RAG_REL), { recursive: true }).catch(() => void 0);
+  await writeFile12(join31(root, RAG_REL, "rag_engine.py"), RAG_ENGINE_PY, "utf8");
 }
 async function ragReindex(root) {
   const py = await detectPython();
   if (!py.found) return { ok: false, started: false, error: "python3 not found" };
-  if (!existsSync16(join30(root, RAG_REL, ".installed"))) return { ok: false, started: false, error: "RAG is not installed" };
-  if (existsSync16(join30(root, RAG_REL, ".indexing"))) return { ok: true, started: true };
+  if (!existsSync16(join31(root, RAG_REL, ".installed"))) return { ok: false, started: false, error: "RAG is not installed" };
+  if (existsSync16(join31(root, RAG_REL, ".indexing"))) return { ok: true, started: true };
   await ensureEngine(root);
   const script = `
 set +e
@@ -44606,12 +45049,12 @@ rm -f "${RAG_REL}/.indexing"
 async function ragQuery(root, queryText, k2 = 8) {
   const py = await detectPython();
   if (!py.found) return { results: [], error: "python3 not found" };
-  if (!existsSync16(join30(root, RAG_REL, "index.db"))) return { results: [], error: "no index \u2014 reindex first" };
+  if (!existsSync16(join31(root, RAG_REL, "index.db"))) return { results: [], error: "no index \u2014 reindex first" };
   await ensureEngine(root);
   try {
-    const { stdout } = await run10(
+    const { stdout } = await run11(
       py.bin,
-      [join30(RAG_REL, "rag_engine.py"), "query", queryText, String(Math.min(Math.max(k2, 1), 20))],
+      [join31(RAG_REL, "rag_engine.py"), "query", queryText, String(Math.min(Math.max(k2, 1), 20))],
       { cwd: root, timeout: 3e4, maxBuffer: 4 * 1024 * 1024 }
     );
     const parsed = JSON.parse(stdout.trim() || '{"results":[]}');
@@ -44626,9 +45069,9 @@ async function ragInstall(root, model) {
   }
   const py = await detectPython();
   if (!py.found) return { ok: false, started: false, error: "python3 not found on the worker" };
-  if (existsSync16(join30(root, RAG_REL, ".installing"))) return { ok: true, started: true };
+  if (existsSync16(join31(root, RAG_REL, ".installing"))) return { ok: true, started: true };
   try {
-    await mkdir11(join30(root, RAG_REL), { recursive: true });
+    await mkdir11(join31(root, RAG_REL), { recursive: true });
   } catch {
   }
   const script = `
@@ -44656,7 +45099,7 @@ rm -f "${RAG_REL}/.installing"
 
 // src/core/config-sync.ts
 import { existsSync as existsSync17, readFileSync as readFileSync16 } from "fs";
-import { join as join31 } from "path";
+import { join as join32 } from "path";
 var SERVER_MANAGED_KEYS = [
   "physicPath",
   "sessionSwitchPct",
@@ -44673,7 +45116,7 @@ var SERVER_MANAGED_KEYS = [
   "projectAiMemoryBudgetChars"
 ];
 function readConfigText(profileDir2) {
-  const path = join31(profileDir2, "config.json");
+  const path = join32(profileDir2, "config.json");
   if (existsSync17(path)) {
     try {
       return readFileSync16(path, "utf8");
@@ -45160,14 +45603,14 @@ var WsClient = class {
    */
   awaitConnected(timeoutMs) {
     if (this.sessionKey && this.bus.status === "connected") return Promise.resolve(true);
-    return new Promise((resolve12) => {
+    return new Promise((resolve13) => {
       const waiter = () => {
         clearTimeout(timer);
-        resolve12(true);
+        resolve13(true);
       };
       const timer = setTimeout(() => {
         this.connectWaiters = this.connectWaiters.filter((w2) => w2 !== waiter);
-        resolve12(false);
+        resolve13(false);
       }, timeoutMs);
       this.connectWaiters.push(waiter);
     });
@@ -45194,16 +45637,16 @@ var WsClient = class {
       this.forceReconnect = false;
       return Promise.resolve();
     }
-    return new Promise((resolve12) => {
+    return new Promise((resolve13) => {
       const timer = setTimeout(() => {
         this.wakeReconnect = null;
-        resolve12();
+        resolve13();
       }, ms2);
       this.wakeReconnect = () => {
         clearTimeout(timer);
         this.wakeReconnect = null;
         this.forceReconnect = false;
-        resolve12();
+        resolve13();
       };
     });
   }
@@ -45257,7 +45700,7 @@ var WsClient = class {
    * One WS session: token → connect → handshake → handle messages until close.
    */
   connectOnce() {
-    return new Promise((resolve12, reject) => {
+    return new Promise((resolve13, reject) => {
       void (async () => {
         this.sessionEstablished = false;
         this.bus.setStatus("connecting");
@@ -45358,7 +45801,7 @@ var WsClient = class {
           if (code === CLOSE_DRAINING) {
             this.bus.log(t("error.serverDraining"));
           }
-          resolve12();
+          resolve13();
         });
         socket.on("error", (err) => {
           this.clearHeartbeat();
@@ -45396,6 +45839,14 @@ var WsClient = class {
         this.startUsagePolling();
         this.startLogUpload();
         this.startKbRefresh();
+        const servedRoot = () => this.physicRoot;
+        startGitSnapshots({
+          get physicRoot() {
+            return servedRoot();
+          },
+          profileDir: this.context.profileDir,
+          send: (channel, data) => this.send(channel, data, null)
+        });
         setToolHealthSink((report) => this.send(WsChannels.TOOL_HEALTH, report));
         this.connectWaiters.splice(0).forEach((fn) => fn());
         return;
@@ -45484,7 +45935,7 @@ var WsClient = class {
    * Used for quota.check before spawning an AI cli (ADR-0020).
    */
   request(channel, data) {
-    return new Promise((resolve12, reject) => {
+    return new Promise((resolve13, reject) => {
       if (!this.socket || !this.sessionKey) {
         reject(new Error("Not connected to the server."));
         return;
@@ -45504,7 +45955,7 @@ var WsClient = class {
       }, 15e3);
       timer.unref?.();
       this.pending.set(envelope.id, {
-        resolve: (value) => resolve12(value),
+        resolve: (value) => resolve13(value),
         timer
       });
       this.socket.send(JSON.stringify(envelope));
@@ -45573,7 +46024,7 @@ var WsClient = class {
    */
   physicFolderPath(projectName) {
     const safe = projectName.replace(/[/\\]/g, "_").replace(/\.\./g, "_").trim();
-    return safe ? join32(this.context.profileDir, safe) : null;
+    return safe ? join33(this.context.profileDir, safe) : null;
   }
   /**
    * Report machine.status: version + the state of the physic project being served
@@ -45685,7 +46136,7 @@ var WsClient = class {
    */
   uploadLog() {
     try {
-      const upload = readLogUpload(join32(this.context.profileDir, "logs"));
+      const upload = readLogUpload(join33(this.context.profileDir, "logs"));
       if (!upload) return;
       const sig = `${upload.fileName}:${upload.totalBytes}`;
       if (sig === this.lastLogSig) return;
@@ -45848,9 +46299,9 @@ var WsClient = class {
 
 // src/core/instance-lock.ts
 import { readFileSync as readFileSync17, rmSync as rmSync9, writeFileSync as writeFileSync9 } from "fs";
-import { join as join33 } from "path";
+import { join as join34 } from "path";
 function lockPath(profileDir2) {
-  return join33(profileDir2, "start.lock");
+  return join34(profileDir2, "start.lock");
 }
 function isAlive(pid) {
   try {
@@ -46172,7 +46623,7 @@ var SessionBus = class {
 // src/core/control-server.ts
 import { createServer } from "net";
 import { chmodSync as chmodSync5, rmSync as rmSync10 } from "fs";
-import { join as join35 } from "path";
+import { join as join36 } from "path";
 
 // src/core/control-protocol.ts
 var CONTROL_SOCKET_FILE = "control.sock";
@@ -46203,9 +46654,9 @@ function createFrameParser() {
 // src/core/control-token.ts
 import { chmodSync as chmodSync4, readFileSync as readFileSync18, writeFileSync as writeFileSync10 } from "fs";
 import { randomBytes as randomBytes3, timingSafeEqual } from "crypto";
-import { join as join34 } from "path";
+import { join as join35 } from "path";
 function controlTokenPath(profileDir2) {
-  return join34(profileDir2, CONTROL_TOKEN_FILE);
+  return join35(profileDir2, CONTROL_TOKEN_FILE);
 }
 function writeControlToken(profileDir2) {
   const token = randomBytes3(32).toString("hex");
@@ -46234,7 +46685,7 @@ function tokenMatches(expected, given) {
 
 // src/core/control-server.ts
 function startControlServer(bus, profileDir2, info) {
-  const socketPath = join35(profileDir2, CONTROL_SOCKET_FILE);
+  const socketPath = join36(profileDir2, CONTROL_SOCKET_FILE);
   try {
     rmSync10(socketPath, { force: true });
   } catch {
@@ -51410,24 +51861,24 @@ var App = class extends import_react9.PureComponent {
       })
     }));
   };
-  findNextFocusable = (state2) => {
-    const activeIndex = state2.focusables.findIndex((focusable) => {
-      return focusable.id === state2.activeFocusId;
+  findNextFocusable = (state3) => {
+    const activeIndex = state3.focusables.findIndex((focusable) => {
+      return focusable.id === state3.activeFocusId;
     });
-    for (let index = activeIndex + 1; index < state2.focusables.length; index++) {
-      const focusable = state2.focusables[index];
+    for (let index = activeIndex + 1; index < state3.focusables.length; index++) {
+      const focusable = state3.focusables[index];
       if (focusable?.isActive) {
         return focusable.id;
       }
     }
     return void 0;
   };
-  findPreviousFocusable = (state2) => {
-    const activeIndex = state2.focusables.findIndex((focusable) => {
-      return focusable.id === state2.activeFocusId;
+  findPreviousFocusable = (state3) => {
+    const activeIndex = state3.focusables.findIndex((focusable) => {
+      return focusable.id === state3.activeFocusId;
     });
     for (let index = activeIndex - 1; index >= 0; index--) {
-      const focusable = state2.focusables[index];
+      const focusable = state3.focusables[index];
       if (focusable?.isActive) {
         return focusable.id;
       }
@@ -51623,8 +52074,8 @@ var Ink = class {
     }
   }
   async waitUntilExit() {
-    this.exitPromise ||= new Promise((resolve12, reject) => {
-      this.resolveExitPromise = resolve12;
+    this.exitPromise ||= new Promise((resolve13, reject) => {
+      this.resolveExitPromise = resolve13;
       this.rejectExitPromise = reject;
     });
     return this.exitPromise;
@@ -51992,10 +52443,10 @@ var import_react26 = __toESM(require_react(), 1);
 
 // src/core/input-history.ts
 import { existsSync as existsSync20, readFileSync as readFileSync20, writeFileSync as writeFileSync11 } from "fs";
-import { join as join36 } from "path";
+import { join as join37 } from "path";
 var MAX_HISTORY = 200;
 function historyPath(profileDir2) {
-  return join36(profileDir2, "input-history.json");
+  return join37(profileDir2, "input-history.json");
 }
 function loadInputHistory(profileDir2) {
   const path = historyPath(profileDir2);
@@ -52609,7 +53060,7 @@ async function runStart(profileDir2, profileName) {
     return;
   }
   logger.configure({
-    dir: join37(profileDir2, "logs"),
+    dir: join38(profileDir2, "logs"),
     level: resolveLogLevel(),
     base: { version: CLI_VERSION, profile: profileName, scope: credential.scope }
   });
@@ -52677,7 +53128,7 @@ async function runStart(profileDir2, profileName) {
           logger.error("ws.run.crash", { message: e.message, stack: e.stack });
           if (client.isStopped) return;
           bus.log(t("start.recovered", { message: e.message }), "error");
-          await new Promise((resolve12) => setTimeout(resolve12, 1e3));
+          await new Promise((resolve13) => setTimeout(resolve13, 1e3));
         }
       }
     };
@@ -52719,12 +53170,12 @@ async function runStart(profileDir2, profileName) {
 }
 
 // src/commands/attach.ts
-import { join as join38 } from "path";
+import { join as join39 } from "path";
 
 // src/core/control-client.ts
 import { connect as connect2 } from "net";
 function connectControl(socketPath, bus, token) {
-  return new Promise((resolve12, reject) => {
+  return new Promise((resolve13, reject) => {
     const socket = connect2(socketPath);
     socket.setEncoding("utf8");
     let ready = false;
@@ -52777,7 +53228,7 @@ function connectControl(socketPath, bus, token) {
           bus.setTokens(frame.tokens);
           for (const entry of frame.transcript) bus.pushEntry(entry);
           ready = true;
-          resolve12({ info: frame.info, close });
+          resolve13({ info: frame.info, close });
           break;
         case "transcript":
           bus.pushEntry(frame.entry);
@@ -52828,7 +53279,7 @@ async function runAttach(profileDir2, profileName) {
     process.exitCode = 1;
     return;
   }
-  const socketPath = join38(profileDir2, CONTROL_SOCKET_FILE);
+  const socketPath = join39(profileDir2, CONTROL_SOCKET_FILE);
   const bus = new SessionBus();
   let conn;
   try {
@@ -52859,13 +53310,13 @@ async function runAttach(profileDir2, profileName) {
 
 // src/commands/auto-run.ts
 import { connect as connect3 } from "net";
-import { join as join39 } from "path";
+import { join as join40 } from "path";
 var AUTO_RUN_TIMEOUT_MS = 3 * 60 * 60 * 1e3;
 async function runAutoRun(profileDir2, profileName) {
   initI18n(readProfileConfig(profileDir2).locale);
-  const socketPath = join39(profileDir2, CONTROL_SOCKET_FILE);
+  const socketPath = join40(profileDir2, CONTROL_SOCKET_FILE);
   const token = readControlToken(profileDir2);
-  const code = await new Promise((resolve12) => {
+  const code = await new Promise((resolve13) => {
     let settled = false;
     const done = (c) => {
       if (settled) return;
@@ -52875,7 +53326,7 @@ async function runAutoRun(profileDir2, profileName) {
         socket.destroy();
       } catch {
       }
-      resolve12(c);
+      resolve13(c);
     };
     const socket = connect3(socketPath);
     socket.setEncoding("utf8");
@@ -52920,22 +53371,22 @@ async function runAutoRun(profileDir2, profileName) {
 
 // src/commands/git-credential.ts
 import { connect as connect4 } from "net";
-import { join as join40 } from "path";
+import { join as join41 } from "path";
 var REQUEST_TIMEOUT_MS = 2e4;
 function requestToken(host, path) {
   const profileDir2 = process.env[PROFILE_DIR_ENV];
   if (!profileDir2) return Promise.resolve(null);
   const token = readControlToken(profileDir2);
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     let done = false;
     const finish = (value) => {
       if (done) return;
       done = true;
       clearTimeout(timer);
       socket.destroy();
-      resolve12(value);
+      resolve13(value);
     };
-    const socket = connect4(join40(profileDir2, CONTROL_SOCKET_FILE));
+    const socket = connect4(join41(profileDir2, CONTROL_SOCKET_FILE));
     socket.setEncoding("utf8");
     const timer = setTimeout(() => finish(null), REQUEST_TIMEOUT_MS);
     socket.on("connect", () => {
@@ -52993,16 +53444,16 @@ import { spawn as spawn12 } from "child_process";
 import { mkdirSync as mkdirSync10 } from "fs";
 import { basename as basename8 } from "path";
 function runProviderLogin(cmd, envVar, dir2) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     const child = spawn12(cmd, [], {
       stdio: "inherit",
       env: { ...process.env, [envVar]: dir2 }
     });
     child.on("error", (err) => {
       console.error(t("aiLogin.launchFailed", { cmd, message: err.message }));
-      resolve12(1);
+      resolve13(1);
     });
-    child.on("exit", (code) => resolve12(code ?? 0));
+    child.on("exit", (code) => resolve13(code ?? 0));
   });
 }
 async function runAiLogin(profileDir2, profileName, aiFilter) {
@@ -53142,10 +53593,10 @@ function Picker({
   ] });
 }
 function selectFromList(items, title) {
-  return new Promise((resolve12) => {
+  return new Promise((resolve13) => {
     let chosen = null;
     const app = render_default(/* @__PURE__ */ (0, import_jsx_runtime7.jsx)(Picker, { items, title, onDone: (v2) => chosen = v2 }));
-    void app.waitUntilExit().then(() => resolve12(chosen));
+    void app.waitUntilExit().then(() => resolve13(chosen));
   });
 }